Why It Matters

pull_request_target runs with elevated repository context. If the workflow then checks out the untrusted pull request head, it effectively combines privileged context with attacker-controlled code.

What Triggers

SEC326 applies to semantically confirmed GitHub Actions workflow YAML and triggers when:

• the workflow listens to pull_request_target
• and an actions/checkout step explicitly checks out github.event.pull_request.head.* or github.head_ref

Example that triggers:

on:
  pull_request_target:
jobs:
  verify:
    steps:
      - uses: actions/checkout@v6
        with:
          ref: ${{ github.event.pull_request.head.sha }}

Example that stays clean:

on:
  pull_request_target:
jobs:
  verify:
    steps:
      - uses: actions/checkout@v6

False Positives

The rule is structural and specifically tied to pull_request_target plus untrusted head checkout. It does not fire on ordinary pull_request workflows or on default checkout behavior.

Remediation

Avoid checking out untrusted pull request head refs in pull_request_target workflows. Keep the safer default merge-context behavior or split privileged and untrusted execution into separate jobs.