GitHub Actions environment secret not available in a fork PR

By Daniel Zoghalchali·Latchkey

Workflows triggered by pull_request from a fork run without access to secrets, including environment secrets, by design. A step expecting a deploy token from a fork PR sees an empty value.

What this error means

A step that uses an environment secret fails or skips when the run originates from a forked PR, but works on branch pushes.

Error: Input required and not supplied: token
# secrets.DEPLOY_TOKEN is empty for pull_request from a fork

Common causes

Fork PRs run without secrets

To protect secrets from untrusted forks, pull_request runs from forks have no access to repository or environment secrets.

How to fix it

Gate secret use or use a safe trigger

1. Skip secret-dependent steps when the PR comes from a fork (github.event.pull_request.head.repo.fork).
2. For trusted automation, use a separate workflow on a safe trigger (for example pull_request_target) with strict checkout controls.
3. Re-run.

- name: Deploy preview
  if: github.event.pull_request.head.repo.fork == false
  run: ./deploy.sh
  env:
    TOKEN: ${{ secrets.DEPLOY_TOKEN }}

How to prevent it

• Do not rely on secrets in workflows triggered by fork PRs.
• Isolate secret-using steps behind a fork check or a separate trusted trigger.

Frequently asked questions

Related guides

References

• GitHub Actions documentation
• Workflow syntax for GitHub Actions