GitHub Actions change will silence workflows in 27% of top 1,000 starred repos by November

GitHub is rolling out two breaking changes to its pull_request_target workflow trigger, with a key deadline of November 2, 2026, when the trigger will be blocked on public repositories lacking an explicit Actions policy. A scan of the 1,000 most-starred public GitHub repositories, conducted on September 26, 2026, found that 269 of them run at least one workflow on pull_request_target, meaning those workflows will stop executing unless maintainers update their policies. Since July 20, 2026, the actions/checkout action already refuses to check out fork pull request code in privileged workflows unless opted in, causing step failures in at least nine repositories. Three repositories were found using an older pinned version of actions/checkout that bypasses the new guard entirely, leaving fork code accessible alongside workflow tokens and secrets — identified as the most urgent security risk. A free open-source tool called prt-check was developed to help repository maintainers audit their own workflows for these issues in a single step.