What is the 'GITHUB_TOKEN' permission model for GitHub Actions workflows triggered by pull requests from forks?
Select an answer to reveal the explanation.
Short Explanation and Infographic
GitHub is security-conscious about forks. When a PR comes from a fork, the workflow gets a read-only GITHUB_TOKEN because that's untrusted code that could exfiltrate secrets. Write access requires explicit maintainer approval via the 'pull_request_target' event or approval gates.
Full explanation below image
Full Explanation
GitHub Actions applies a security restriction to workflows triggered by pull requests from forked repositories. By default, these workflows receive a GITHUB_TOKEN with read-only permissions, and organization secrets are NOT passed to these workflows. This protection prevents a scenario where a malicious contributor forks a repository and opens a PR containing a workflow that reads organization secrets or modifies repository data. For maintainers who need to run workflows with elevated permissions on fork PRs (e.g., for contributors that don't have write access), GitHub provides: (1) 'pull_request_target' event which runs in the context of the base repository (with write access), (2) Manual approval requirement for first-time contributors' workflows, (3) 'Approve and run' workflow controls.