GitHub Actions Checkout Now Blocks Risky pull_request_target Checkouts

GitHub released actions/checkout v7 to block common unsafe patterns where privileged workflows (e.g., pull_request_target or certain workflow_run events) check out and execute attacker-controlled code from forked pull requests. The change prevents typical fork-ref checkouts by default and introduces an explicit allow-unsafe-pr-checkout opt-out; the report ties this update to prior high-impact supply-chain compromises (Nx, PostHog/Shai-Hulud, TanStack) and notes that the guardrail reduces but does not eliminate risks from other checkout mechanisms or workflow misconfigurations.