GitHub Actions Checkout Now Blocks Risky pull_request_target Checkouts
GitHub Actions Checkout v7 now blocks risky pull_request_target checkouts by default.
GitHub has released actions/checkout v7, introducing a default protection against a significant supply chain risk: privileged workflows that check out and execute code from untrusted pull requests. This change prevents common "pwn request" patterns in workflows running under pull_request_target or certain workflow_run events, which previously could lead to the theft of repository secrets or unauthorized write permissions. While this is a significant step, GitHub notes it's a guardrail, and other methods of fetching untrusted code within privileged workflows still require careful review.
AI summary of the linked source. Not reviewed by an editor. How this works
Run GitHub?
Get an email when a new story names GitHub, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonThe root cause of this risk lies in misconfigured CI/CD workflows that use privileged triggers like `pull_request_target` or `workflow_run` while checking out and executing code from untrusted external pull requests — a pattern known as a 'pwn request.' This design flaw allowed attackers to craft malicious pull requests that, when processed by a privileged workflow, could exfiltrate repository secrets or gain unauthorized write access. GitHub's actions/checkout v7 introduces a default guardrail, but it does not eliminate all attack vectors, meaning developers who fetch untrusted code through other means remain exposed. This matters because CI/CD pipelines are high-value targets in software supply chain attacks, and a single compromised workflow can cascade into a full repository or organizational breach.
What helps against this
How we list vendors
- Software supply chain security
Malicious and vulnerable open-source packages are caught before they ship.