Topic Thread

#workflow-security

1 published observation tracking this thread.

GitHub Actions workflow branching from an untrusted pull request into a guarded security policy gate

GitHub Actions Is Turning pull_request_target Into an Explicit Security Exception

GitHub is moving a risky GitHub Actions trigger from an easy-to-misconfigure workflow choice toward an explicit policy decision. The change is important for open-source maintainers, especially repositories that process fork pull requests.

2026-09-19#GitHub Actions · #supply chain security