[BUG]: Some workflows will stop working on Dec 2, 2026 #3297

Is this a duplicate?

• I confirmed there appear to be no duplicate issues for this bug and that I agree to the Code of Conduct

Type of Bug

Something else

Component

Infrastructure

Describe the bug

Github is showing the following warning:

[.github/workflows/pr-metadata-check.yml#L1](https://github.com/NVIDIA/cuda-python/actions/runs/41079871118/workflow)
On December 2, 2026, GitHub will restrict `pull_request_target` on public repositories by default. To continue allowing the event trigger, configure an Actions policy. Learn more: https://gh.io/securely-using-pull_request_target#default-policy-for-pull_request_target

(sol 6.1 high)

This is a warning about an upcoming GitHub policy, rather than a YAML syntax error. GitHub currently evaluates the restriction; enforcement starts December 2, 2026. GitHub’s explanation

I found three affected workflows:

• pr-metadata-check.yml
• pr-auto-label.yml
• backport.yml

I recommend retaining pull_request_target and explicitly allowing it through an Actions policy. The metadata check uses the trusted base workflow to enforce merge requirements; labeling and backporting need write permissions for fork PRs.

A repository administrator should:

1. Open NVIDIA/cuda-python → Settings → Actions → Policies.
2. Create or update an event policy scoped to these workflows.
3. Explicitly allow pull_request_target, preserving workflow_dispatch for backporting.
4. Activate the policy and check Policy insights. Any applicable organization or enterprise restrictions must also permit the event.

GitHub documents these controls under Governing workflow execution.

How to Reproduce

This warning shows up on pr-metadata-check.yml

Expected behavior

On december 2, this should all continue working.

Operating System

No response

nvidia-smi output

No response