GitHub Updates actions/checkout to Block Common Pwn Request Attack Patterns

The 'pwn request' attack exploits the `pull_request_target` workflow trigger, which runs with elevated repository privileges even when the code originates from an untrusted fork — creating a dangerous trust boundary violation in CI/CD pipelines. Attackers can leverage this to execute arbitrary code with access to repository secrets and the GITHUB_TOKEN, effectively compromising the entire software supply chain. This matters because CI/CD pipelines have become high-value targets: a single compromised workflow can lead to secret exfiltration, malicious code injection into builds, or full repository takeover. GitHub's June 2026 update enforces safer defaults, but organizations relying on custom workflows must audit their own configurations proactively rather than waiting for the deadline.