GitHub will block a risky Actions trigger on 2 December. The first brownout is 9 November.

On Monday, 2 November, GitHub said Actions will block pull_request_target events by default in all public repositories from 2 December 2026, a month after the date it had planned. Two brownouts come first, on 9 and 16 November from 16:00 to 18:00 UTC, when blocked runs fail. Private and internal repositories are not affected, and neither is GitHub Enterprise Server.

That trigger runs in your base repository with access to its secrets, so a workflow that runs code from a fork can hand a stranger your pipeline. And if your release flow depends on it, the build simply won't run during a brownout.

Check Insights before 9 November for runs the rule would block. If a workflow truly needs pull_request_target, allow only that workflow in an Actions event policy; otherwise let the block stand.