THE PWN REQUEST RECKONING: WHAT STILL WORKS AGAINST GITHUB ACTIONS

Summary from the TLDR DevOps newsletter

GitHub's upcoming platform changes in 2026 will make pull_request_target attacks harder, but gaps remain involving outdated checkout versions, script injection, and unprotected triggers like issue_comment. Pinning actions to old SHA values predating the July 2026 backport release bypasses the new checkout protections entirely. The default policy also does not apply to private repositories or workflow_run events.