GitHub Actions: workflow execution protections are generally available, pull_request_target disabled by default

2026-09-17 · Publisher : GitHub · Domain : Cloud & DevOps

On 17 September 2026, GitHub makes Actions workflow execution protections generally available. A default rule disables pull_request_target in public repositories, enforced on 2 November 2026.

### Background On 17 September 2026, GitHub announces general availability of workflow execution protections for GitHub Actions, after a public preview. They let you define an allowlist controlling who can trigger a workflow and which events can start it. It is one of the building blocks announced in the 26 March 2026 security roadmap. ### Key facts - Actor rules (who) and event rules (what), evaluated before each run; available for enterprises, organizations and repositories. - New at general availability: workflow file targeting, an "Insights" view to audit the effect of rules and a REST API to manage policy as code. - Evaluate mode remains available: rules run in simulation and show the runs that would be blocked. - New default: in public repositories with no applicable event policy, a rule disables pull_request_target; it does not apply to private or internal repositories. - Automatic enforcement of the default rule on 2 November 2026, for affected repositories that were using the default policy before general availability. ### Why it matters pull_request_target is behind many pipeline compromises because it runs fork code with access to secrets. By disabling it by default for public repositories, GitHub applies the advice security teams had repeated for years. Maintainers have until 2 November to review their workflows with Insights and explicitly allow the trigger if needed. ### Takeaway GitHub closes by default the most exploited entry point of public pipelines: maintainers have until 2 November 2026 to prepare.

Tags : Sécurité, CI/CD, DevOps, Open Source