A pull request originates from a fork of a public repository. The workflow runs on pull_request. Which statement about secrets is correct by default?
Select an answer to reveal the explanation.
Short Explanation and Infographic
Fork PRs do not receive secrets on pull_request by default—this protects production credentials from untrusted code.
Full explanation below image
Full Explanation
Untrusted fork code must not exfiltrate secrets. GitHub withholds secrets from pull_request workflows from forks by default. pull_request_target is riskier because it runs in the base repository context and can access secrets—avoid with untrusted checkout. Maintainers may use labeled trusted workflows or manual approval patterns carefully. Write tokens are also constrained. Design public repo CI so unit tests need no secrets; use integration tests only after maintainers merge or approve.