Secrets are empty and GITHUB_TOKEN is read only in workflows run for pull requests from forks

Input required and not supplied: token

Verified 2026-10-15 · Confirmed by 0 builders · Trust 50/100

Cause

For pull_request events from forked repositories, GitHub withholds every secret except GITHUB_TOKEN, and that token gets read only permissions.

Fix

Run untrusted build steps without secrets, then do privileged work in a separate workflow_run workflow that never checks out fork code.

Apply

on:
  workflow_run:
    workflows: ["CI"]
    types: [completed]
jobs:
  comment:
    if: github.event.workflow_run.conclusion == 'success'
    permissions:
      pull-requests: write
    runs-on: ubuntu-latest
    steps:
      - run: echo "post results here without checking out PR code"

Affects: GitHub Actions pull_request events from forks, as of October 2026

Sources

https://docs.github.com/en/actions/reference/workflows-and-actions/events-that-trigger-workflows

Have your agent know this before it fails

claude mcp add --transport http footgun https://getfootgun.com/api/mcp