What GitHub's pull_request_target changes break in the 1,000 most-starred repositories
What GitHub’s pull_request_target changes break in the 1,000 most-starred repositories
GitHub is changing how pull_request_target works this year. Two dated changes affect every public repository that uses the trigger, so I built a small free checker, prt-check, with my AI engineering system (HAL), and ran it over the 1,000 most-starred repositories on GitHub.
GitHub 今年正在更改 pull_request_target 的工作方式。有两项有时效性的变更会影响所有使用该触发器的公共仓库，因此我利用我的 AI 工程系统 (HAL) 构建了一个小型免费检查工具 prt-check，并对 GitHub 上星标数最多的 1,000 个仓库进行了扫描。
Check your own repository in one step:
- uses: actions/checkout@v4
- uses: UniteAndCreateForLife/prt-check@v1
Or run python prt_check.py locally (no dependencies).
只需一步即可检查您自己的仓库：
- uses: actions/checkout@v4
- uses: UniteAndCreateForLife/prt-check@v1
或者在本地运行 python prt_check.py（无需依赖）。
The two changes: since 2026-07-20, actions/checkout refuses to check out fork pull request code in pull_request_target and workflow_run workflows unless you opt in (changelog). From 2026-11-02, GitHub blocks pull_request_target on public repositories that have no Actions policy allowing it (changelog).
这两项变更分别是：自 2026 年 7 月 20 日起，除非您明确选择加入（查看更新日志），否则 actions/checkout 将拒绝在 pull_request_target 和 workflow_run 工作流中检出 fork 的拉取请求代码。自 2026 年 11 月 2 日起，GitHub 将在没有设置允许该触发器的 Actions 策略的公共仓库上屏蔽 pull_request_target（查看更新日志）。
Scanned 2026-09-26, 37 days before GitHub’s default block on 2026-11-02, with prt-check. Aggregate numbers only: this report names no repository.
扫描于 2026 年 9 月 26 日，即 GitHub 默认屏蔽日期（2026 年 11 月 2 日）前 37 天，使用 prt-check 完成。仅提供汇总数据：本报告不点名任何仓库。
The numbers: 269 of 1,000 (26.9%) run at least one workflow on pull_request_target (540 workflow files). Unless their maintainers allow the trigger in an Actions policy, those workflows stop running on 2026-11-02.
数据如下：1,000 个仓库中有 269 个（26.9%）在 pull_request_target 上运行了至少一个工作流（共 540 个工作流文件）。除非维护者在 Actions 策略中允许该触发器，否则这些工作流将在 2026 年 11 月 2 日停止运行。
9 (0.9%) check out fork pull request code in a privileged workflow, with an actions/checkout that has the new guard and no condition that keeps forks out. Since 2026-07-20 the guard refuses those checkouts, so the steps fail for pull requests from forks. Label-gated ones fail when the label is added.
有 9 个（0.9%）仓库在特权工作流中检出了 fork 的拉取请求代码，且使用的 actions/checkout 包含新防护机制，但没有排除 fork 的条件。自 2026 年 7 月 20 日起，防护机制会拒绝这些检出操作，因此来自 fork 的拉取请求会导致步骤失败。受标签限制的工作流会在添加标签时失败。
3 check out fork code in a privileged workflow with actions/checkout pinned to a version or commit from before the guard. The guard doesn’t apply to them, so the fork’s code is checked out where the workflow’s token and secrets are. They are the most urgent to fix, and this report does not name them.
有 3 个仓库在特权工作流中检出了 fork 代码，且 actions/checkout 被锁定在防护机制引入之前的版本或提交上。防护机制对它们无效，因此 fork 的代码会被检出到拥有工作流令牌和密钥的环境中。这些是最紧急需要修复的，本报告不点名它们。
4 opted in with allow-unsafe-pr-checkout: true: a deliberate decision, safe only if no later step executes the fork’s files.
有 4 个仓库选择了 allow-unsafe-pr-checkout: true：这是一个慎重的决定，只有在后续步骤不执行 fork 文件的情况下才是安全的。
9 fetch pull request code with git fetch ...pull/... or gh pr checkout in a privileged workflow. That path bypasses the new guard in actions/checkout.
有 9 个仓库在特权工作流中使用 git fetch ...pull/... 或 gh pr checkout 获取拉取请求代码。这种方式绕过了 actions/checkout 中的新防护机制。
8 run an AI or review action on pull_request_target. Those reviewers go quiet on 2026-11-02 unless the trigger is allowed.
有 8 个仓库在 pull_request_target 上运行 AI 或审查操作。除非允许该触发器，否则这些审查工具将在 2026 年 11 月 2 日失效。
What runs on pull_request_target today
目前在 pull_request_target 上运行的内容
The actions used most often in these workflows, by the number of repositories that use them there: 在这些工作流中使用频率最高的 Action（按使用仓库数量排序）：
| Action | Repositories |
|---|---|
| actions/github-script | 125 |
| actions/labeler | 50 |
| actions/create-github-app-token | 25 |
| actions/setup-node | 22 |
| actions/setup-python | 16 |
| amannn/action-semantic-pull-request | 13 |
| eps1lon/actions-label-merge-conflict | 12 |
| actions/upload-artifact | 12 |
| contributor-assistant/github-action | 10 |
| step-security/harden-runner | 6 |
| dorny/paths-filter | 6 |
| actions/download-artifact | 6 |
AI and review actions on the trigger: 触发器上的 AI 和审查 Action：
| Action | Repositories |
|---|---|
| anthropics/claude-code-action | 5 |
| presubmit/ai-reviewer | 1 |
| anthropics/claude-code-base-action | 1 |
| openai/codex-action | 1 |
Method
方法
Selection: the 1,000 most-starred public, non-fork, non-archived repositories, from GitHub’s repository search on 2026-09-26. 809 of them have workflow files (9,328 files in total). 0 could not be read. Only .github/workflows/*.yml and *.yaml on the default branch were read, through the GitHub API and raw.githubusercontent.com. No workflow was run, and nothing was written anywhere. Each file went through prt_check.py, which reads YAML line by line.
选择标准：2026 年 9 月 26 日通过 GitHub 仓库搜索获取的星标数最多的 1,000 个公共、非 fork、非归档仓库。其中 809 个包含工作流文件（总计 9,328 个文件）。0 个文件无法读取。仅通过 GitHub API 和 raw.githubusercontent.com 读取了默认分支上的 .github/workflows/*.yml 和 *.yaml 文件。没有运行任何工作流，也没有写入任何内容。每个文件都经过 prt_check.py 处理，该脚本逐行读取 YAML。
README lists the codes, and the tests show the layouts it understands. Every repository behind the second and third numbers was reviewed by hand, and the checker was corrected wherever the review found it wrong: job conditions, Dependabot-only jobs, workflow_run upstreams and branch filters, and commit pins resolved to exact actions/checkout releases.
README 列出了代码，测试展示了它能理解的布局。对第二和第三组数据背后的每个仓库都进行了人工审查，并在审查发现错误的地方修正了检查工具：包括作业条件、仅限 Dependabot 的作业、workflow_run 上游和分支过滤器，以及解析到确切 actions/checkout 版本的提交锁定。
Actions policies (repository, organization or enterprise) are not visible from outside, so some of these repositories may already allow pull_request_target and keep running it after 2026-11-02. The numbers count workflows that depend on the trigger, not workflows that will certainly stop.
Actions 策略（仓库、组织或企业级）在外部不可见，因此其中一些仓库可能已经允许了 pull_request_target，并在 2026 年 11 月 2 日之后继续运行。这些数字统计的是依赖该触发器的工作流，而不是一定会停止的工作流。
What to do
如何处理
Run prt-check on your repository (Action or one command), then follow the three fixes in the README: switch to pull_request, split into pull_request + workflow_run, or keep the trigger deliberately with an Actions policy.
在您的仓库上运行 prt-check（通过 Action 或单条命令），然后按照 README 中的三种修复方法操作：切换到 pull_request，拆分为 pull_request + workflow_run，或者通过 Actions 策略明确保留该触发器。
Source code, tests and the full method: https://github.com/UniteAndCreateForLife/prt-check. If you hit a false positive, open an issue and I’ll fix it.
源代码、测试和完整方法：https://github.com/UniteAndCreateForLife/prt-check。如果您遇到误报，请提交 Issue，我会进行修复。