Docker and CI/CD · Middle · Question 38 of 75
Why don't workflows triggered by pull_request from forks get repository secrets?
- 1Secrets work only on the default branch by design
- 2Forks are on a different GitHub plan without secrets
- ✓Correct answer: Fork code is untrusted and could send the secrets out
Explanation
Anyone can open a PR that changes the workflow or test code. pull_request_target runs with secrets, which is why checking out PR code there is dangerous.