build1 publisher
A workflow_run chain keeps the fork's code out of the job that holds the secrets
GitHub gives forked pull requests a read-only token and no secrets, so any test that needs a credential fails. The two documented ways around that differ in whose code the secrets-bearing job actually checks out.
Publishers:dev.to
Reality
- Evidence58
- Adoption
- Insufficient
- Hype gap−5
- Incentives28
- Confidence52