other

workflow_run

A GitHub Actions event trigger that starts one workflow when another completes, and can access secrets and write tokens even when the preceding workflow could not.

Current clusters

build1 publisher

A workflow_run chain keeps the fork's code out of the job that holds the secrets

GitHub gives forked pull requests a read-only token and no secrets, so any test that needs a credential fails. The two documented ways around that differ in whose code the secrets-bearing job actually checks out.

Publishers:dev.to

Reality

Evidence58
Adoption: Insufficient
Hype gap−5
Incentives28
Confidence52