What is the 'pull_request_target' event in GitHub Actions and when should it be used carefully?
Select an answer to reveal the explanation.
Short Explanation and Infographic
pull_request_target is powerful but dangerous. It runs in the base repo context — so it HAS secrets and write access. When you process untrusted fork code in this event, you risk code execution with elevated privileges. Always sandbox the checkout of fork code.
Full explanation below image
Full Explanation
The 'pull_request_target' event runs the workflow in the context of the TARGET (base) repository, meaning it has access to repository secrets and the GITHUB_TOKEN has write permissions. This is different from 'pull_request' events which run with restricted permissions for fork PRs. Use cases for pull_request_target: labeling PRs from forks, posting comments on fork PRs, triggering deployment workflows for trusted fork contributions. Security warning: if a workflow triggered by pull_request_target checks out and executes the PR's code (e.g., using actions/checkout with the PR's ref), it runs potentially malicious fork code with full write access and secrets. Best practice: when using pull_request_target with code checkout, run the untrusted code in an isolated environment or strictly limit what the checked-out code can execute.