What do you mean "by default"? By default workflows simply aren't run, not even when you push to master. You need to explicitly include the 'pull_request' or 'p

What do you mean "by default"? By default workflows simply aren't run, not even when you push to master. You need to explicitly include the 'pull_request' or 'pull_request_target' event in the 'on' section of your workflow in order to build PRs. And you can implement a whitelist with reasonable ease if you want to. However, it turns out — who would have guessed — people do want to build random PRs, because 99% of PRs aren't jerks trying to mine crypto. --- Edit: To expand on the 'pull_request_target' event, it was introduced later and defends against running arbitrary unsanctioned workflows. It could have been introduced earlier, and maybe made more prominent, but there's a tradeoff.