Fork pull request fails for missing secrets: keep untrusted CI unprivileged

Compare the trust context, not the secret value

A maintainer finds that a contribution passes on an internal branch but fails from a fork or Dependabot. Check the event and source repository first. Missing secrets and a read-only token can be intentional protection rather than a misconfigured credential. Public fork runs may also wait for maintainer approval. Never print a token or secret to discover whether it is present.

• Record which step needs an external service and why.
• Separate a permission error from a test assertion or missing package.

Build a useful credential-free test path

Identify what can run against synthetic fixtures, disposable local services or a mock without production credentials. Preserve meaningful unit and integration assertions. If a real provider test is essential, design a separately authorised trusted execution path with limited credentials and human review of the exact revision; do not make every contributed branch privileged.

• Label any omitted provider test so green does not imply it ran.
• Do not replace a failed provider test with an unconditional success.

Changing the event can change the security boundary

pull_request_target is not a general fix for missing fork secrets. It runs in the base repository context and is useful for controlled metadata work, but checking out and executing untrusted PR code there can expose credentials or poison caches. Keep contributed executable code away from privileged jobs. Maintainer approval to start a run does not by itself make arbitrary submitted code safe.

• Review checkout references, downloaded scripts and build commands together.
• Do not attach credentials or grant write permissions through an enquiry.

Acceptance and limits

Require a safe fork test to exercise the agreed assertions without secret access, and verify that any separately approved privileged path does not execute unreviewed contribution code. Keep a real failing assertion to show failures remain visible. This is a bounded workflow repair, not a complete security audit. Scope, account authority and a quote are agreed before private work.