What GitHub's pull_request_target changes break in the 1,000 most-starred repositories

A developer built prt-check, a free static analysis tool, and scanned the 1,000 most-starred GitHub repositories ahead of two dated changes to the pull_request_target trigger. The scan found 540 workflow files using the trigger that will stop running on 2026-11-02 unless maintainers allow it in an Actions policy, and flagged checkouts that will fail for fork pull requests since the 2026-07-20 actions/checkout guard. The report names no repositories and offers three fixes: switch to pull_request, split into pull_request plus workflow_run, or keep the trigger deliberately with an Actions policy.

GitHub is changing how pull request target works this year. Two dated changes affect every public repository that uses the trigger, so I built a small free checker, prt-check https://github.com/UniteAndCreateForLife/prt-check , with my AI engineering system HAL , and ran it over the 1,000 most-starred repositories on GitHub. Check your own repository in one step: - uses: actions/checkout@v4 - uses: UniteAndCreateForLife/prt-check@v1 Or run python prt check.py locally no dependencies . The two changes: since 2026-07-20, actions/checkout refuses to check out fork pull request code in pull request target and workflow run workflows unless you opt in changelog https://github.blog/changelog/2026-06-18-safer-pull request target-defaults-for-github-actions-checkout/ . From 2026-11-02, GitHub blocks pull request target on public repositories that have no Actions policy allowing it changelog https://github.blog/changelog/2026-09-17-workflow-execution-protections-in-github-actions-generally-available/ . Scanned 2026-09-26, 37 days before GitHub's default block on 2026-11-02, with prt-check https://github.com/UniteAndCreateForLife/prt-check . Aggregate numbers only: this report names no repository. pull request target 540 workflow files . Unless their maintainers allow the trigger in an Actions policy, those workflows stop running on 2026-11-02. actions/checkout that has the new guard and no condition that keeps forks out. Since 2026-07-20 the guard refuses those checkouts, so the steps fail for pull requests from forks. Label-gated ones fail when the label is added. allow-unsafe-pr-checkout: true : a deliberate decision, safe only if no later step executes the fork's files. git fetch ...pull/... or gh pr checkout in a privileged workflow. That path bypasses the new guard in The actions used most often in these workflows, by the number of repositories that use them there: | Action | Repositories | |---|---| | actions/github-script | 125 | | actions/labeler | 50 | | actions/create-github-app-token | 25 | | actions/setup-node | 22 | | actions/setup-python | 16 | | amannn/action-semantic-pull-request | 13 | | eps1lon/actions-label-merge-conflict | 12 | | actions/upload-artifact | 12 | | contributor-assistant/github-action | 10 | | step-security/harden-runner | 6 | | dorny/paths-filter | 6 | | actions/download-artifact | 6 | AI and review actions on the trigger: | Action | Repositories | |---|---| | anthropics/claude-code-action | 5 | | presubmit/ai-reviewer | 1 | | anthropics/claude-code-base-action | 1 | | openai/codex-action | 1 | .github/workflows/ .yml and .yaml on the default branch were read, through the GitHub API and raw.githubusercontent.com. No workflow was run, and nothing was written anywhere. prt check.py , which reads YAML line by line. workflow run upstreams and branch filters, and commit pins resolved to exact Run prt-check on your repository Action or one command , then follow the three fixes in the README https://github.com/UniteAndCreateForLife/prt-check how-to-fix : switch to pull request , split into pull request + workflow run , or keep the trigger deliberately with an Actions policy. Source code, tests and the full method: https://github.com/UniteAndCreateForLife/prt-check https://github.com/UniteAndCreateForLife/prt-check . If you hit a false positive, open an issue and I'll fix it.