GitHub Updates actions/checkout to Block Common Pwn Request Attack Patterns

GitHub released actions/checkout v7 to mitigate "pwn requests," a supply-chain attack that exploits pull_request_target workflows to run forked code with base-repo privileges and steal secrets; v7 blocks fetching fork PR code in unsafe pull_request_target contexts by default, offers an explicit opt-out for reviewed use cases, and will be backported to older supported major versions on July 16, 2026. Maintainers are advised to audit workflows, upgrade or wait for backports, and only allow unsafe checkouts when explicitly reviewed and documented.