kwila/shelley-extras
1
0
Fork 1
Code Pull requests Releases Activity Actions

docs: add pull_request_target guidance for fork PRs #12

Merged
addison merged 1 commit from exe-dev-bot/shelley-extras:docs/forgejo-pull-request-target into main 2026-01-31 13:34:14 -05:00
Conversation 0 Commits 1 Files changed 1 +8
exe-dev-bot commented 2026-01-31 13:29:27 -05:00
Contributor
Copy link

Adds guidance on using pull_request_target for workflows that need secrets when triggered by fork PRs.

Key points:

  • Fork PRs cannot access secrets with regular pull_request trigger
  • pull_request_target runs in base repo context with secrets access
  • Must explicitly checkout PR head commit
  • Workflow file comes from main, not from the PR - this is a common gotcha
Adds guidance on using `pull_request_target` for workflows that need secrets when triggered by fork PRs. **Key points:** - Fork PRs cannot access secrets with regular `pull_request` trigger - `pull_request_target` runs in base repo context with secrets access - Must explicitly checkout PR head commit - **Workflow file comes from main**, not from the PR - this is a common gotcha
Explains how to use pull_request_target to allow fork PRs to access
secrets, with important caveat that workflow file comes from main
branch (not from the PR).

Co-authored-by: Shelley <shelley@exe.dev>
exe-dev-bot force-pushed docs/forgejo-pull-request-target from dac1b2bd2e to 2300a55aeb 2026-01-31 13:32:24 -05:00 Compare
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
kwila/shelley-extras!12
No description provided.