By default, when a pull_request workflow runs from a forked repository, are secrets available?
Select an answer to reveal the explanation.
Short Explanation and Infographic
Fork PRs are treated as untrusted — by default, secrets are withheld to prevent an attacker from stealing credentials through a fake PR.
Full explanation below image
Full Explanation
For security, GitHub does not pass secrets to workflows triggered by pull_request events from forked repositories. The GITHUB_TOKEN is also given read-only permissions in this scenario. This prevents a malicious actor from forking a public repo, creating a PR with code that dumps secrets, and stealing credentials. Workarounds (used with caution): 'pull_request_target' trigger (runs in base repo context), manual approval via 'repository_dispatch' after reviewing the PR, or enabling 'Allow pull requests from forks to have access to secrets' in repository settings (not recommended). There's no concept of 'public' secrets.