# pull_request_target should not check out PRs

pull_request_target runs in the base repo and can read that repo's secrets. Checking out the pull request head runs the pull request's code in that job.

Published 2026-11-09.

## The trigger and the checkout are one finding

A workflow with `on: pull_request_target` runs in the base repository. It can read that repository's secrets. The workflow that matters is the one on the base branch, which is why a fork can hit it before anyone merges the fork's workflow change.

The checkout this check is written for is `ref: ${{ github.event.pull_request.head.sha }}`, or the same idea with `head.ref`. The pull-request-target check looks for `pull_request_target` together with a checkout of the head ref or head sha. It reads the workflow YAML. It does not open the pull request. A `pull_request` workflow is not this finding. A `pull_request_target` job that checks out only the base repository is not this finding either. Both halves have to be in the file you paste.

## Read the diff without running it

If the job only needs the diff, fetch the diff and print the paths. Don't `actions/checkout` the head, and don't `run` a script from the pull request. If the job has to build the pull request, use `pull_request`. A `pull_request` from a fork does not receive the base repository's secrets. A `pull_request` from a branch in the same repository can.

Paste the workflow. Quote the `on:` block and the checkout `ref`. `permissions: contents: write` is a different line. This check does not read it. `uses: actions/checkout@main` is the action-pin check.

## Related

- [Pull request target check](https://skaleagents.com/checks/pull-request-target-checkout)
- [Action pinned to @main](https://skaleagents.com/checks/action-pinned-to-main)
- [Pin the action to a commit](https://skaleagents.com/blog/pin-the-action-to-a-commit)