Audit GitHub Actions checkout before the July 16 pwn-request backport

Confirmed: GitHub Actions actions/checkout v7 now refuses common pwn-request patterns by default. The change matters before July 16, 2026, when GitHub says the enforcement will be backported to all currently supported major versions. Teams with workflows pinned to exact SHAs, minor versions, or patch versions must update deliberately; floating major tags such as actions/checkout@v4 are expected to receive the protection automatically.

What changed

GitHub changed actions/checkout so privileged workflows stop fetching fork pull request code in the riskiest common cases. The block applies to pull_request_target workflows and to workflow_run workflows when the original event was a pull request event.

The refusal is triggered when the pull request comes from a fork and the checkout resolves to the fork repository, a refs/pull/.../head or refs/pull/.../merge ref, or the fork pull request head or merge commit SHA. Same-repository pull requests are not affected, and the regular pull_request event is unchanged.

Key takeaways

• actions/checkout@v7 is already generally available with the safer default.
• July 16, 2026 is the backport date for currently supported major versions.
• Floating major pins should receive the behavior automatically; exact pins need manual updates.
• The opt-out flag is allow-unsafe-pr-checkout, and it should be treated as a security exception.
• The guardrail does not cover manual git, GitHub CLI, custom scripts, unrelated third-party repositories, or other event types such as issue_comment.

Practical LinkLoot angle

This is a rare security update that can both prevent compromise and break CI in the same week. Audit workflows that combine elevated permissions with forked pull requests, package installs, local actions, generated artifacts, cache restore/save steps, or OIDC publishing access.

For automation-heavy teams, this belongs in the same review queue as AI-assisted workflow automation and release-bot permissions. Start with repositories that publish packages, deploy previews, write comments with privileged tokens, or run tests for external contributors.

What to verify before you act

• Search for pull_request_target and workflow_run workflows that call actions/checkout.
• Check whether checkout is pinned to a floating major, exact SHA, minor version, or patch version.
• Look for ref: ${{ github.event.pull_request.head.sha }}, refs/pull/..., or repository: ${{ github.event.pull_request.head.repo.full_name }}.
• Review any allow-unsafe-pr-checkout use as a privileged exception, not a convenience flag.
• Confirm manual git, gh, shell, cache, and package-install steps are not rebuilding the same pwn-request path outside actions/checkout.

Source check

Confirmed by GitHub: actions/checkout v7 refuses common pwn-request patterns by default, the backport date is July 16, 2026, and exact pins are not automatically covered.

Independent context: The Hacker News corroborates the rollout and explains why pull_request_target can expose secrets and privileged GITHUB_TOKEN access when paired with untrusted fork code.

For adjacent automation reviews, see LinkLoot's guide to AI workflow automation.