Safer pull_request_target defaults for GitHub Actions checkout - GitHub Changelog

Safer pull_request_target defaults for GitHub Actions checkout The pull_request_target event is one of the most commonly misused triggers in GitHub Actions, leading to vulnerabilities in workflows. Workflows triggered by pull_request_target run with the base repository’s GITHUB_TOKEN, secrets, and default-branch cache access. Checking out the head of an unreviewed pull request from a fork inside o

[mkusaka]

GitHub Changelog: actions/checkout v7はpull_request_targetでforkの危険なcheckoutをデフォルト拒否し安全化。