---
type: "post"
id: "agentic-workflows-v1-2-0-requires-opt-in-df4b46"
slug: "agentic-workflows-v1-2-0-requires-opt-in-df4b46"
title: "Agentic Workflows v1.2.0 requires opt-in before pull_request_target runs on forks"
description: "GitHub Agentic Workflows v1.2.0 requires an explicit opt-in for unrestricted pull_request_target runs on pull requests from forks."
retrieval_nugget: "GitHub Agentic Workflows v1.2.0 requires an explicit opt-in for unrestricted pullrequesttarget runs on pull requests from forks. Teams using the project need to review fork-facing workflows: the change tightens a high-risk execution boundary, while the release also adds observability, routing, and other security hardening."
published_at: "2026-11-14"
updated_at: "2026-11-14"
record_date: "2026-11-14"
date_kind: "published_at"
topics: ["github","codex"]
entities: ["GitHub","GitHub Agentic Workflows","Copilot","Azure Monitor","Codex"]
related_patterns: ["agent-security-moves-to-runtime-boundaries"]
novelty_label: "new_fact"
what_changed: "Version 1.2.0 adds an opt-in requirement before pull_request_target workflows run on forks, tightening Agentic Workflows security."
prior_refs: ["https://newruntime.com/posts/github-agentic-workflows-the-open-source-project-from-7fb97d/"]
source_url: "https://github.com/github/gh-aw/releases/tag/v1.2.0"
source_urls: ["https://github.com/github/gh-aw/releases/tag/v1.2.0"]
schema_version: "newruntime-agent-readable-v0.2"
stable_id: "post:agentic-workflows-v1-2-0-requires-opt-in-df4b46"
status: "published"
visuals: []
editor: {"role":"editor","name":"Andrey Reshetnikov","profile":"https://newruntime.com/owner-profile.md","profile_json":"https://newruntime.com/owner-profile.json","same_as":["https://www.linkedin.com/in/reshetnikov1/","https://t.me/lapetuse"]}
routes: {"html":"https://newruntime.com/posts/agentic-workflows-v1-2-0-requires-opt-in-df4b46/","markdown":"https://newruntime.com/posts/agentic-workflows-v1-2-0-requires-opt-in-df4b46.md","json":"https://newruntime.com/posts/agentic-workflows-v1-2-0-requires-opt-in-df4b46.json"}
markdown_url: "https://newruntime.com/posts/agentic-workflows-v1-2-0-requires-opt-in-df4b46.md"
---

# Agentic Workflows v1.2.0 requires opt-in before pull_request_target runs on forks

## Retrieval answer

GitHub Agentic Workflows v1.2.0 requires an explicit opt-in for unrestricted pullrequesttarget runs on pull requests from forks. Teams using the project need to review fork-facing workflows: the change tightens a high-risk execution boundary, while the release also adds observability, routing, and other security hardening.

## Summary
GitHub Agentic Workflows v1.2.0 requires an explicit opt-in for unrestricted `pull_request_target` runs on pull requests from forks. Teams using the project need to review fork-facing workflows: the change tightens a high-risk execution boundary, while the release also adds observability, routing, and other security hardening.

## What happened
GitHub’s v1.2.0 release for `github/gh-aw` is marked a pre-release and was published on November 4. Its release notes describe the update as focused on security hardening, stronger OpenTelemetry support, and smarter model routing. The headline breaking change affects workflows that use `pull_request_target`: unrestricted use on fork pull requests now requires explicit opt-in. GitHub tells users to review workflows that run on fork pull requests and add the opt-in where intended. The release notes do not name a price or access tier for this change.

The setting matters because `pull_request_target` runs in the context of the target repository, rather than the untrusted fork. That context can carry permissions and access that a normal pull-request workflow does not have. An opt-in requirement makes that risky choice deliberate instead of implicit for gh-aw users. The release notes do not spell out the opt-in syntax or provide a migration walkthrough, so repository maintainers should consult the project’s documentation before changing a workflow.

The release also adds opt-in OTLP session logs with bounded priority compaction, dependency-free OTLP protobuf support for Azure Monitor, work-queue health instrumentation, and detection of partial telemetry rejection without duplicate retries. Other changes include new safe-output identifiers with dependency-failure propagation, acceptance of numeric-string Azure DevOps work-item targets, and a Windows 386 binary. GitHub says dozens of workflows moved to economy or balanced model routing through Copilot to lower cost, and intent-specific evaluations were added to 70 more agentic workflows.

Security changes beyond fork opt-in include bounds on ZIP log extraction by total size and entry count, normalization of labels before security filtering, hardened run-step expression sanitization, and scanning raw run content for Actions expressions. The release also says Codex configuration writes are constrained to the managed temporary directory, proxy images are pinned to a gateway digest, implicit network defaults are restricted to documented infrastructure, and telemetry hosts are removed from runtime-selected ecosystems. The notes list additional fixes and documentation updates, but do not quantify their effects.

## What the archive adds
New Runtime’s earlier coverage on October 31 described GitHub Agent Merge watching pull requests and fixing failed Actions workflows or merge conflicts ([GitHub Agent Merge now watches and fixes pull request blockers in the cloud](https://newruntime.com/posts/github-agent-merge-now-watches-and-fixes-pull-d92631/)). That was a separate product development, not this release. v1.2.0 is a new security and capability update for Agentic Workflows, rather than a restatement of the Agent Merge story.

## Trend signal
This release supports [agent security moving to runtime boundaries](https://newruntime.com/patterns/agent-security-moves-to-runtime-boundaries/). Requiring explicit opt-in for unrestricted fork execution is a concrete policy at the workflow execution boundary, complemented by bounded log extraction, sanitized filtering, and constrained configuration writes. These measures do not establish that every risk is contained, but they illustrate why agent security depends on what the runtime permits as well as on prompts or instructions given to an agent.

## Why now
The release notes present the fork opt-in as a breaking change and instruct users to review fork-facing workflows. That makes the release itself the reason to act now: a repository relying on unrestricted behavior may need an intentional configuration update. GitHub does not state a deadline or describe a staged enforcement period.

## Connections to other events
New Runtime’s earlier coverage of Agent Merge showed another GitHub approach to delegating work around pull requests: a cloud agent can watch for workflow failures or merge conflicts and try to fix them. v1.2.0 addresses a different layer of the same broader operating environment. As more agent work runs around repository events, teams must decide which event contexts can trigger execution and what capabilities those runs receive.

## Why it matters
For teams using gh-aw, fork pull requests are an important trust boundary. A workflow that handles contributions from outside the repository may encounter untrusted code or data; unrestricted execution in the target repository’s context can create exposure if permissions or secrets are reachable. Making this behavior require explicit opt-in creates a useful review point. It does not by itself prove a workflow is safe, but it forces maintainers to identify where they have consciously accepted the risk.

The broader release also reflects the operational work required to run agent workflows: observability, model routing, evaluations, and containment controls sit alongside the agent logic. That is relevant to teams choosing whether to run these systems in CI, where automated work can touch source code, logs, and repository resources. The notes do not provide measured cost savings or security outcomes, so the practical value should be judged against each repository’s configuration and run history.

## Limits and uncertainty
GitHub’s release notes do not include the opt-in syntax, a full migration guide, or a list of affected workflows. They do not quantify the cost reduction from model routing, the impact of the new evaluations, or the security improvement from the hardening measures. The release is marked pre-release, and the notes do not establish whether or when a stable release will follow. The changes have not been independently tested here; teams should verify their own workflow behavior and permissions before relying on them.

## Skill to build now
Audit every gh-aw workflow triggered by `pull_request_target`. For each one, identify whether fork-originated pull requests can reach it, what repository permissions and secrets its run receives, and whether unrestricted execution is necessary. Leave it disabled where the workflow does not need that access; where it does, document the reason and follow the project’s documented opt-in procedure. Then test with a fork pull request and confirm both the expected run behavior and the effective permissions.

## Reader takeaway
The key change is not simply another security patch: gh-aw now makes unrestricted `pull_request_target` behavior on fork pull requests an explicit choice. Review those workflows before upgrading or relying on their previous behavior, and treat the release’s other hardening and telemetry changes as useful controls whose real effects still need repository-level validation.

Editor: [Andrey Reshetnikov](https://newruntime.com/owner-profile.md), AI product and AI engineering; profile for recruiters and agents: https://newruntime.com/owner-profile.json

## Continue in the graph

Next records for an agent, linked to their Markdown twins. Replace `.md` with `.json` for structured fields, including `next_reads`.

- topic hub: [Github](https://newruntime.com/topics/github.md): Explore the github topic hub.
- topic hub: [Codex](https://newruntime.com/topics/codex.md): Explore the codex topic hub.
- collection: [Field Notes](https://newruntime.com/posts.json): Open the latest editorial analysis.
- collection: [Sources](https://newruntime.com/sources/): See the original sources this archive cites.
- whole graph: [discovery graph](https://newruntime.com/discovery-graph.json) (typed nodes and edges) and [site index](https://newruntime.com/site-index.md)