ci: configure Actions policies for pull_request_target #1938

GitHub currently shows this warning on affected workflows:

On November 2, 2026, GitHub will restrict pull_request_target on public repositories by default. To continue allowing the event trigger, configure an Actions policy. Learn more: https://gh.io/securely-using-pull_request_target#default-policy-for-pull_request_target

Before November 2, 2026, configure applicable GitHub Actions event policies that explicitly allow pull_request_target where it is still required, so PR automation continues running. Review existing policies and policy insights first; GitHub's default policy does not replace an applicable event policy already configured.

Repositories

Public, non-archived MDN repositories with matching default-branch workflows as of September 22, 2026 (excluding legacy mdn/yari). Check each repository once its required workflows are covered by an applicable policy, or no longer need this event.

• mdn/bcd-utils
• mdn/browser-compat-data
• OIDC test repository
• mdn/client-toolchain-example
• mdn/content
• mdn/css-examples
• mdn/curriculum
• mdn/dex
• mdn/django-locallibrary-tutorial
• mdn/dom-examples
• mdn/express-locallibrary-tutorial
• mdn/fred
• mdn/mcp
• mdn/mdn-http-observatory
• mdn/project-template
• mdn/rari
• mdn/rumba
• mdn/todo-react
• mdn/todo-vue
• mdn/translated-content
• mdn/translated-content-de
• mdn/translated-content-it
• mdn/tree-sitter-mdn
• mdn/triagebot
• mdn/watify
• mdn/workflows

Completion criteria

• Confirm each repository's required pull_request_target workflows are allowed by an applicable Actions event policy before enforcement.
• Review policy insights to verify those workflows will not be blocked.

See GitHub's policy configuration guide and security guidance for this event.