Avoid unsafe patterns for public repo pull requests.
Section: OIDC and fork safety
Do not expose secrets to untrusted forks
yaml
yaml
on:
pull_request:Explanation
Be careful with workflows that run untrusted code from forks. Avoid combining privileged tokens or secrets with unreviewed pull request code paths.
Learn the surrounding workflow
Compare similar commands or jump into common fixes when this command is part of a bigger troubleshooting path.
Related commands
Same sheet · prioritizing OIDC and fork safety
Enable OIDC token issuance
Grant `id-token: write` when using cloud federation.
Configure AWS credentials via OIDC
Use the AWS credentials action without long-lived keys.
Authenticate to Google Cloud with OIDC
Use workload identity federation for GCP.
Mask a dynamic sensitive value
Hide a generated or fetched secret from logs.