GitHub’s pull_request_target Changes Impact 26.9% of Top Starred Repositories

GitHub is implementing significant changes to the pull_request_target functionality in its Actions system, which will affect a substantial portion of the most popular public repositories on the platform. The changes, scheduled for implementation in 2026, will require repository maintainers to explicitly allow the trigger in their Actions policies or risk having their workflows stop functioning. A developer named Unite and Create For Life has created a free tool called prt-check to help identify repositories affected by these changes. The tool was run across the 1,000 most-starred public repositories on GitHub, revealing that 26.9% (269 repositories) run at least one workflow on pull_request_target. Without an explicit Actions policy allowing the trigger, these workflows will stop running on November 2, 2026. Additionally, 9 repositories check out fork pull request code in privileged workflows without proper conditions, causing failures since July 20, 2026. Three repositories use pinned versions of actions/checkout that bypass the new guard, making them particularly urgent to fix. The analysis also found that 4 repositories opted in with allow-unsafe-pr-checkout: true, which is safe only if no later steps execute forked code. The most commonly used actions in these workflows include actions/github-script (used in 125 repositories), actions/labeler (50), and actions/create-github-app-token (25). The report emphasizes that repository maintainers should run the prt-check tool on their repositories and follow the recommended fixes: switching to pull_request, splitting workflows into pull_request + workflow_run, or explicitly allowing the trigger with an Actions policy. The developer behind the tool has made the source code available on GitHub for transparency and community contribution. The report concludes that while some repositories may already have the necessary policies in place, the majority of affected workflows will need attention before the November 2, 2026 deadline.