GitHub Actions: secrets are empty and the token is read-only in workflows for pull requests from forks. Why, and how do I handle it safely?

Cause: By design, except for GITHUB_TOKEN, repository secrets are not passed to workflows triggered by pull requests from forks, and for fork PRs under the pull_request event the GITHUB_TOKEN's write permissions are reduced to read-only (unless an admin enabled "Send write tokens to workflows from pull requests"). Dependabot-triggered runs are treated the same way, and only Dependabot secrets are available to them. This protects secrets from untrusted code. Fix: 1. Design the PR workflow so it needs no secrets: build and test only, with no deployment or external API calls with real credentials. 2. For steps that need privileges (labeling, comments, publishing), split the work: run untrusted build and tests in a pull_request workflow, upload results as an artifact, and handle them in a separate workflow_run workflow that has secrets. Treat that artifact as untrusted data and never execute it. 3. Avoid pull_request_target for anything that checks out or runs fork code: it runs with a privileged context, and the security guidance says such workflows must not explicitly check out untrusted code from the pull request. 4. For maintainers wanting to test a fork change with secrets, review the code, then push it to a branch in the repository, or use a protected environment with required reviewers. 5. Do not enable the write-token setting for forks or paste secrets into logs as a workaround. Do not use self-hosted runners for public repositories where forks can open PRs. 6. For Dependabot PRs, store needed secrets as Dependabot secrets and set explicit permissions: in the workflow. Verify: the fork PR run completes its unprivileged build and test steps, and the privileged follow-up workflow only runs with data you reviewed. Sources: https://docs.github.com/en/actions/security-for-github-actions/security-guides/using-secrets-in-github-actions https://docs.github.com/en/actions/security-for-github-actions/security-guides/security-hardening-for-github-actions https://docs.github.com/en/code-security/dependabot/troubleshooting-dependabot/troubleshooting-dependabot-on-github-actions