Maintainers want outside contributors’ workflows from forks to run only after someone with write access approves the run. Which GitHub Actions security control addresses first-time contributors from forks?
Select an answer to reveal the explanation.
Short Explanation and Infographic
Fork PR approval settings let maintainers gate Actions runs from outside contributors. Widening token permissions, disabling protection, or moving secrets into variables makes things worse—not better.
Full explanation below image
Full Explanation
GitHub provides controls so workflows triggered by pull requests from forks—especially first-time contributors—may require approval before running. That reduces risk of abuse (crypto mining, secret probing) on public repos. Combined with the default that fork PR workflows do not receive repository secrets, approval gates form a layered defense. Granting contents: write or disabling branch protection does not safely solve fork trust and can increase risk. Repository variables are visible to workflows that can read them and must never hold secrets. Document for contributors that integration tests needing secrets run only after merge or on trusted paths.