GitHub's pull_request_target changes hit 269 of 1,000 top repositories

GitHub now blocks actions/checkout from fetching fork code in pull_request_target workflows without opt-in since July 20, 2026, and will block the trigger on public repos without an allowing Actions policy from November 2. A scan of the 1,000 most-starred repositories found 269 (26.9%) rely on pull_request_target across 540 workflow files, with 9 checking out fork code in privileged workflows.

• 269 of 1,000 repositories (26.9%) run at least one workflow on pull_request_target
• 9 repositories check out fork code in privileged workflows and break after November 2
• 3 repositories pin actions/checkout to pre-guard versions, bypassing the new block
• Since July 20, 2026 actions/checkout refuses fork checkouts without opt-in