Pull_request_target with PR-head checkout (pwn-request)
Part of the Actions supply chain check · fix arrives as a guide
What it is
A workflow triggered by pull_request_target checks out the pull request head — ref: github.event.pull_request.head.sha or the equivalent — and then runs build or test steps from it.
Why it matters
This is the pwn-request pattern. pull_request_target runs with repository secrets and a write-capable token, and checking out the fork's code executes a stranger's scripts with all of it.
How to fix it
Do not check out untrusted code in a pull_request_target workflow. Use pull_request for anything that runs PR code, and keep pull_request_target to steps that only read metadata such as labelling or commenting.
Run them all on your app
Connect your repo and your live services with read-only scopes. The first scan is free, and nothing changes without your approval.