GitHub Actions 12月2日起默认阻断pull_request_target
pull_request_target blocked by default December 2
公共仓库 CI/CD 核心触发器将被默认禁用，直接影响自动化构建与测试流程。请务必在 12 月 2 日前检查 Actions 策略，显式允许依赖 pull_request_target 的工作流，否则流水线将中断。
Starting December 2, 2026, GitHub Actions will block pull_request_target events by default in all public repositories, unless an applicable Actions event policy explicitly allows them. Enforcement was previously scheduled for November 2, 2026.
自 2026 年 12 月 2 日起，GitHub Actions 将默认阻止所有公共仓库中的 pull_request_target 事件，除非适用的 Actions 事件策略明确允许。此前计划的强制执行日期为 2026 年 11 月 2 日。
GitHub introduced this default rule through workflow execution protections. The rule initially runs in evaluate mode, so you can see which workflow runs it would block before enforcement begins.
GitHub 通过工作流执行保护功能引入了此默认规则。该规则最初以评估模式运行，因此你可以在强制执行开始前查看它将阻止哪些工作流运行。
Private and internal repositories aren’t affected.
私有仓库和内部仓库不受影响。
Why we’re making this change
我们为何进行此项更改
pull_request_target runs in the context of the base repository and can access its secrets. If a workflow executes untrusted code from a fork, that code could compromise your pipeline or steal secrets. The default rule helps reduce this risk while letting you explicitly allow workflows that depend on the trigger.
pull_request_target 在基础仓库的上下文中运行，并可访问其密钥。如果工作流执行来自分叉仓库的不可信代码，这些代码可能会破坏你的流水线或窃取密钥。默认规则有助于降低此类风险，同时允许你显式允许依赖该触发器的工作流。
Brownout schedule
限电计划（Brownout schedule）
Before permanent enforcement begins on December 2, 2026, we’ll temporarily enforce the default protection during two scheduled brownouts. These windows will help you identify affected workflows and update your policies before enforcement becomes permanent.
在 2026 年 12 月 2 日正式强制执行之前，我们将在两个预定的限电时段临时强制执行默认保护。这些时段将帮助你识别受影响的工作流，并在强制执行变为永久之前更新你的策略。
| Date | Time (UTC) |
|---|---|
| November 9, 2026 | 16:00–18:00 |
| November 16, 2026 | 16:00–18:00 |
| 日期 | 时间 (UTC) |
|---|---|
| 2026 年 11 月 9 日 | 16:00–18:00 |
| 2026 年 11 月 16 日 | 16:00–18:00 |
During each window, pull_request_target workflow attempts blocked by the default rule in affected public repositories will create failed runs with an error annotation; the workflows won’t execute. After each window, the default rule will return to evaluate mode, allowing workflows to run with warnings. Private and internal repositories aren’t affected.
在每个时段内，受默认规则阻止的受影响公共仓库中的 pull_request_target 工作流尝试将生成带有错误注释的失败运行；工作流不会执行。每个时段结束后，默认规则将返回到评估模式，允许工作流在发出警告的情况下运行。私有仓库和内部仓库不受影响。
Prepare your workflows
准备工作流
Before the first brownout on November 9, use Insights to see which workflow runs the rule would block. From there, you have two options:
在 11 月 9 日首次限电之前，使用 Insights 查看该规则将阻止哪些工作流运行。随后，你有两种选择：
- Keep the default rule in place to block pull_request_target.
- Explicitly allow pull_request_target in an applicable Actions event policy if your workflows depend on it. Use workflow file targeting to allow specific workflows.
- 保留默认规则以阻止 pull_request_target。
- 如果你的工作流依赖它，请在适用的 Actions 事件策略中显式允许 pull_request_target。使用工作流文件定位来允许特定的工作流。
See how to control workflow execution to configure your policies.
请参阅如何控制工作流执行以配置你的策略。
This change applies to public repositories on GitHub Free, GitHub Team, and GitHub Enterprise Cloud, not GitHub Enterprise Server.
此更改适用于 GitHub Free、GitHub Team 和 GitHub Enterprise Cloud 上的公共仓库，不适用于 GitHub Enterprise Server。
更进一步：量化金融体系
看懂新闻只是起点——沿量化金融路径，把它变成能交付的工程能力