{"slug": "what-github-s-pull-request-target-changes-break-in-the-1000-most-starred", "title": "What GitHub's pull_request_target changes break in the 1,000 most-starred repositories", "summary": "A developer built prt-check, a free static analysis tool, and scanned the 1,000 most-starred GitHub repositories ahead of two dated changes to the pull_request_target trigger. The scan found 540 workflow files using the trigger that will stop running on 2026-11-02 unless maintainers allow it in an Actions policy, and flagged checkouts that will fail for fork pull requests since the 2026-07-20 actions/checkout guard. The report names no repositories and offers three fixes: switch to pull_request, split into pull_request plus workflow_run, or keep the trigger deliberately with an Actions policy.", "body_md": "GitHub is changing how `pull_request_target` works this year. Two dated changes affect every public repository that uses the trigger, so I built a small free checker, **[prt-check](https://github.com/UniteAndCreateForLife/prt-check)**, with my AI engineering system (HAL), and ran it over the 1,000 most-starred repositories on GitHub.\n\n**Check your own repository in one step:**\n\n```\n- uses: actions/checkout@v4\n- uses: UniteAndCreateForLife/prt-check@v1\n```\n\nOr run `python prt_check.py` locally (no dependencies).\n\nThe two changes: since 2026-07-20, `actions/checkout` refuses to check out fork pull request code in `pull_request_target` and `workflow_run` workflows unless you opt in ([changelog](https://github.blog/changelog/2026-06-18-safer-pull_request_target-defaults-for-github-actions-checkout/)). From 2026-11-02, GitHub blocks `pull_request_target` on public repositories that have no Actions policy allowing it ([changelog](https://github.blog/changelog/2026-09-17-workflow-execution-protections-in-github-actions-generally-available/)).\n\n*Scanned 2026-09-26, 37 days before GitHub's default block on 2026-11-02, with [prt-check](https://github.com/UniteAndCreateForLife/prt-check). Aggregate numbers only: this report names no repository.*\n\n`pull_request_target` (540 workflow files). Unless their maintainers allow the trigger in an Actions policy, those workflows stop running on 2026-11-02.`actions/checkout` that has the new guard and no condition that keeps forks out. Since 2026-07-20 the guard refuses those checkouts, so the steps fail for pull requests from forks. Label-gated ones fail when the label is added.`allow-unsafe-pr-checkout: true`: a deliberate decision, safe only if no later step executes the fork's files.`git fetch ...pull/...` or `gh pr checkout` in a privileged workflow. That path bypasses the new guard in The actions used most often in these workflows, by the number of repositories that use them there:\n\n| Action | Repositories | \n|---|---|\n| `actions/github-script` | 125 | \n| `actions/labeler` | 50 | \n| `actions/create-github-app-token` | 25 | \n| `actions/setup-node` | 22 | \n| `actions/setup-python` | 16 | \n| `amannn/action-semantic-pull-request` | 13 | \n| `eps1lon/actions-label-merge-conflict` | 12 | \n| `actions/upload-artifact` | 12 | \n| `contributor-assistant/github-action` | 10 | \n| `step-security/harden-runner` | 6 | \n| `dorny/paths-filter` | 6 | \n| `actions/download-artifact` | 6 | \n\nAI and review actions on the trigger:\n\n| Action | Repositories | \n|---|---|\n| `anthropics/claude-code-action` | 5 | \n| `presubmit/ai-reviewer` | 1 | \n| `anthropics/claude-code-base-action` | 1 | \n| `openai/codex-action` | 1 | \n\n`.github/workflows/*.yml` and `*.yaml` on the default branch were read, through the GitHub API and raw.githubusercontent.com. No workflow was run, and nothing was written anywhere.`prt_check.py`, which reads YAML line by line. `workflow_run` upstreams and branch filters, and commit pins resolved to exact Run `prt-check` on your repository (Action or one command), then follow the three fixes in the [README](https://github.com/UniteAndCreateForLife/prt-check#how-to-fix): switch to `pull_request`, split into `pull_request` + `workflow_run`, or keep the trigger deliberately with an Actions policy.\n\n*Source code, tests and the full method: [https://github.com/UniteAndCreateForLife/prt-check](https://github.com/UniteAndCreateForLife/prt-check). If you hit a false positive, open an issue and I'll fix it.*", "url": "https://wpnews.pro/news/what-github-s-pull-request-target-changes-break-in-the-1000-most-starred", "canonical_source": "https://dev.to/unite_andcreateforlife/what-githubs-pullrequesttarget-changes-break-in-the-1000-most-starred-repositories-1g0m", "published_at": "2026-09-26 22:53:47+00:00", "updated_at": "2026-09-26 23:00:51.118044+00:00", "lang": "en", "topics": ["developer-tools", "ai-agents"], "entities": ["GitHub", "prt-check", "actions/checkout", "actions/github-script", "anthropics/claude-code-action", "openai/codex-action", "GitHub Actions"], "also_reported_by": [], "alternates": {"html": "https://wpnews.pro/news/what-github-s-pull-request-target-changes-break-in-the-1000-most-starred", "markdown": "https://wpnews.pro/news/what-github-s-pull-request-target-changes-break-in-the-1000-most-starred.md", "text": "https://wpnews.pro/news/what-github-s-pull-request-target-changes-break-in-the-1000-most-starred.txt", "jsonld": "https://wpnews.pro/news/what-github-s-pull-request-target-changes-break-in-the-1000-most-starred.jsonld"}}