🚧 Main Branch: The One Where Pull Requests Get Boundaries

Hiya friends,

Two changes landed that decide what a pull request can do and who can see it. One is a moderation tool maintainers have wanted for years. The other is a security default that already applied itself to your workflows whether you read the changelog or not.

🚢 What Shipped

Repository admins can archive pull requests (July 16)

Archiving a PR closes it, locks it, and hides it from everyone except repository admins. Non-admins who hit the URL get a 404. You can archive in bulk or one at a time, and unarchiving brings it back still closed and still locked.

Until now, dealing with a spam or abusive PR meant deleting it and losing the record along with it. Archiving keeps the history for admins while taking it out of public view, which also covers the cases where policy or legal says you are not allowed to delete anything. Maintainers of popular public repos have been asking for this for a long time. Use is:archived to pull them back up during triage.

actions/checkout refuses fork checkouts in pull_request_target (enforcement July 20)

pull_request_target runs with the base repository’s GITHUB_TOKEN, its secrets, and default-branch cache access. Checking out an unreviewed fork PR in that context is the “pwn request” pattern behind several supply chain incidents.

v7 shipped in June refusing it by default. On July 20 that enforcement was backported to every supported major version, so anything on a floating tag like actions/checkout@v4 picked it up automatically. Pinned SHAs did not, and still need upgrading.

This is the shape that now fails:

# pull_request_target workflow, fork PR
- uses: actions/checkout@v4
  with:
    ref: refs/pull/${{ github.event.pull_request.number }}/merge

Same for ref: set to the fork head SHA, or repository: resolving to the fork.

📖 What I’m Reading

The Land and Its People by David Sedaris

I’ve been a Sedaris fan for years and years. I love the way he writes. This one is a collection of essays about being a foreigner, a brother, and a lifelong friend, including a stretch where he tries being a caretaker after his partner’s surgery and lands somewhere between succeeding and failing.

Worth your time if: you like witty writing and need something that gets your head out of work for an hour.

🔧 What I’m Using

Team X-Ray, my own VS Code extension. It reads your local git history, commits, contributors, file ownership, and builds a map of who actually knows what in the repo.

Team X-Ray on the VS Code Marketplace

✨ This Week

I am wrapping up a stretch of travel. I spoke at Nebraska Code last week, which was my first time in Nebraska and my first Midwest conference, and it’s such a great conference. So many thoughtful little details. The people were genuinely kind.

IRL events are still where you meet people and pick up the things you were not looking for. The Nebraska Code organizers cared about keeping a high bar on the talks. They asked speakers not to use AI to do their thinking for them. If you are standing on a stage, you should know your material well enough to talk about it without reading a script back to the room. I talked about Team X-Ray.

My birthday lands this week too, Friday the 31st. Another trip around the sun, and I am grateful to be here with my family and my friends. The older I get the better I feel about the choices/sacrifices I’ve made to just exist, and the more grace I give myself as mom, wife, and friend. Don’t be like me and wait the longest to realize how amazing it is to have real friendships, love and breath in your lungs.

With gratitude,

Andrea

📌 P.S.

Some of you have been reading long enough to remember Issue #20, when Charlie, my oldest dog, tore his CCL. On July 17th we had to let him go, in the most loving and compassionate way we could. He left a big hole in our home, and I think Wilson, our other dog, is taking it hardest of all. That was his buddy. Thank you to everyone who sent a note and understood what he means to us. That part is hard to explain to people who have never had a dog. He was truly one of the family.

I wrote about him and how we got him. If you need a good cry, go read it: Let Me Tell You About Charlie.

The World’s Biggest Dev Event Hits Silicon Valley

One trip, and your team stops guessing on AI adoption, platform, security, and tooling.

WeAreDevelopers World Congress, San José, CA, September 23-25, 2026, in the heart of Silicon Valley. 500+ speakers and 10,000+ developers working through what actually ships in production: coding agents, evals, MCP, observability, agent security.

Kelsey Hightower. Thomas Dohmke (fmr. CEO, GitHub). Christine Yen (CEO, Honeycomb). Mathias Biilmann (CEO, Netlify). Olivier Pomel (CEO, Datadog). The people actually building the tools you use every day, all on one stage.

Bring a shortlist of decisions; leave with answers and contacts you can still reach after the event. Prices rise as we get closer.

Use code GITPUSH26 for 10% off.

Get Your Pass