GitHub to Block pull_request_target Workflows by Default Starting December 2

The `pull_request_target` workflow trigger runs with elevated repository permissions, including access to secrets, even when triggered by code from untrusted forks — creating a significant attack vector for credential theft and supply chain compromise. Threat actors have exploited this design to inject malicious code into CI/CD pipelines, stealing secrets and corrupting open-source releases consumed by thousands of downstream users. GitHub's decision to block this trigger by default acknowledges that many maintainers were unknowingly running privileged workflows against untrusted contributor code. This matters because CI/CD pipeline compromises have become a primary vector for large-scale supply chain attacks, as a single poisoned pipeline can propagate malicious artifacts broadly. Organizations relying on open-source dependencies must understand that upstream pipeline security directly affects their own software supply chain integrity.