GitHub updated actions/checkout: pwn‑request protection in GitHub Actions

Colleagues, note: GitHub changed actions/checkout — it now refuses by default to check out fork PR code in pull_request_target.

What matters:
- Change (from 18.06.2026): refusal to check out from forks via refs/pull/*/head or merge; backport until 16.07.2026.
- Option allow-unsafe-pr-checkout: true allows disabling the protection.
- Risk: pull_request_target runs with GITHUB_TOKEN and secrets — running untrusted code can exfiltrate them.
- Recommendations: use pull_request, restrict workflow permissions and avoid executing unreviewed code.

Why it matters: reduces software supply-chain attack risk.

How will you adapt your CI/CD?

#GitHubActions #Cybersecurity #SupplyChainSecurity #DevSecOps