Question

A public repository runs a CI workflow triggered on pull_request. The security team is concerned that contributors submitting pull requests from forks could exfiltrate repository secrets or run malicious code with elevated permissions. The team wants forked PRs to still get automated build/test feedback, but any workflow run that needs secrets or write access must not execute automatically for first-time or untrusted contributors. Which configuration best addresses this concern with the least additional custom scripting?

Accepted Answer

Enable the repository setting 'Require approval for all outside collaborators' (or 'first-time contributors') under fork pull request workflows so no forked run executes until a maintainer approves; note that pull_request runs from forks still receive NO Actions secrets and a read-only GITHUB_TOKEN, so any step that genuinely needs secrets or write access must use a separate trusted/privileged pattern rather than the fork PR run.

Answer

Switch the workflow trigger to pull_request_target so the workflow runs in the base repository context, and check out the PR head SHA before building and testing it.

Answer

Store the secrets as plaintext repository variables instead of encrypted secrets, since variables are not exposed to forked pull requests.

Answer

Grant the GITHUB_TOKEN permissions: write-all in the workflow so forked PR builds can complete, and rely on branch protection to catch malicious changes at merge time.