Question

Your team maintains a public repository on GitHub that accepts contributions from external forks via pull requests. The CI workflow needs to run integration tests that reference a deployment secret stored in the repository's Actions secrets. A security reviewer warns that a malicious contributor could open a pull request that exfiltrates the secret. You must ensure that secrets are never exposed to workflows triggered by pull requests from forks, while still allowing trusted maintainers to run the full pipeline. What should you do?

Accepted Answer

Rely on the default behavior of the pull_request event, which does not pass repository secrets to workflows triggered from forked repositories, and gate any secret-dependent jobs behind an environment that requires maintainer approval.

Answer

Switch the trigger to pull_request_target so the workflow runs in the context of the base repository and automatically receives secrets for every incoming fork PR.

Answer

Store the secret in a plaintext repository variable instead of an encrypted secret so GitHub can safely mask it during fork pull request runs.

Answer

Add the secret value to the workflow YAML as an input parameter and use continue-on-error so failed masking attempts do not block the pipeline.