A public repository receives a pull request from a fork. For the pull_request event, what is the default availability of repository secrets to the workflow run?
Select an answer to reveal the explanation.
Short Explanation and Infographic
Fork PRs are untrusted compute: by default secrets (and some elevated tokens) are withheld on pull_request from forks so malicious PRs cannot exfiltrate credentials.
Full explanation below image
Full Explanation
GitHub's default security model treats workflows from forked repositories as untrusted. For pull_request events originating from forks, secrets are not passed to the runner. This prevents a malicious fork from running workflow code that prints or ships secrets elsewhere. Maintainers sometimes use pull_request_target (which runs in the base repo context and can access secrets) but that is higher risk if combined with checkout of untrusted code. Approval settings for first-time contributors add another control layer for public repos. Environment secrets do not bypass the fork restriction in the simple way the wrong option claims. Write access on the fork is irrelevant to base-repo secret injection. Prefer writing CI that does not require secrets for fork PR validation.