GitHub Actions will block the pull_request_target trigger by default in public repos from December 2, 2026, with enforcement brownouts on November 9 and 16.