github: pull_request_target blocked by default December 2
Starting December 2, 2026, GitHub Actions will block `pull_request_target` events by default in all public repositories unless an applicable Actions event policy explicitly allows them. The enforcement date was changed from a previous schedule.