GitHub Actions Secrets Empty in Fork Pull Requests

By Daniel Zoghalchali·Latchkey

Secrets come through empty on a pull request from a fork because GitHub withholds secrets from untrusted fork code by design. This is a security boundary, not a bug.

What this error means

A workflow that needs a secret works on branch pushes but fails on PRs opened from forks, where the secret resolves to an empty string and downstream auth fails.

Error: Input required and not supplied: token
# secrets.DEPLOY_TOKEN is empty because the PR came from a fork

Common causes

Forks get no secrets on pull_request

For pull_request events from a fork, GitHub does not expose repository or environment secrets, so untrusted code cannot exfiltrate them.

Misusing pull_request_target

pull_request_target runs with secrets but in the base-repo context. Checking out and running fork code under it is a known security risk.

How to fix it

Split trusted work from untrusted code

Run untrusted fork code without secrets, and do any privileged step in a separate, trusted workflow triggered after.

# untrusted: build/test fork code, no secrets needed
on: pull_request
# privileged steps run from a trusted workflow, e.g. workflow_run,
# and never check out untrusted fork code with secrets present

Use pull_request_target safely if you must

1. Do not check out and execute the PR head code when secrets are present.
2. Use it only for label/comment automation that does not run fork code.
3. Restrict which steps see the secret and pin all actions to a SHA.

How to prevent it

• Design fork PR workflows to not need secrets at all.
• Keep privileged automation in trusted, separately-triggered workflows.
• Treat pull_request_target as high-risk and review it carefully.

Frequently asked questions

Related guides

References

• GitHub Actions documentation
• Workflow syntax for GitHub Actions