GitHub Actions Adds an Admission Gate; pull_request_target Still Needs a Trust Boundary
Cover image: GitHub Actions workflow execution protections, admission gating, and pull_request_target trust boundaries. Photo on Unsplash Miles Park IT engineer and technology analyst based in Virginia. About the author 📌 Key Takeaways Admission Control vs Runtime Sandbox: GitHub Actions workflow execution protections (GA September 17, 2026) enforce actor, event, and file-targeted allowlists before runner startup, but do not sanitize untrusted code once a job begins execution. The pull_request_target Threat Surface: Workflows triggered by pull_request_target run in the context of the base branch with access to repository secrets; checking out and executing untrusted fork PR code remains a critical vulnerability path. November 2, 2026 Rollout Scope: GitHub's planned default block targets public repositories without existing event policies, leaving private/internal repositories and explicitly configured workflows under customer governance. Gi...