Help
cancel
Showing results for 
Search instead for 
Did you mean: 
Highlighted
Copilot Lvl 2
Message 1 of 3

Run a GitHub action on `pull_request` for PR opened from a forked repo

Solved! Go to Solution.

If I create a workflow with an action that runs on `pull_request`, when a pull request is opened on that repo from a forked repo, the action is not triggered.

 

Workflow file:

```

workflow "List environment variables" {
on = "pull_request"
resolves = ["my-action"]
}

action "my-action" {
uses = "./"
}

```

 

Then fork the repo, create a branch, push a commit and open a pull request on the upstream repo. The action is not started for this PR.

 

Is that intentionnal or is it a limitation of the beta?

 

If that case is planned to be supported in the future, will the secret environment variables be available to the action?

 

Thanks!

 

2 Replies
Solution
Ground Controller Lvl 1
Message 2 of 3

Re: Run a GitHub action on `pull_request` for PR opened from a forked repo

Hi @pvdlg, that's intentional and likely to remain the case.

 

This is a mitigation against the possibility that a bad actor could open PRs against your repo and do things like list out secrets or just run up a large bill (once we start charging) on your account. The actions are in fact executed, but it happens against the _fork_, not against the base repo.

 

This does require that the forked repo also has actions enabled though. During the beta period that means that the owner of the forked repo must also be in the beta.

 

Hope this helps clear things up!

Copilot Lvl 2
Message 3 of 3

Re: Run a GitHub action on `pull_request` for PR opened from a forked repo

Hi,

Is this documented somewhere?

 

If I setup https://github.com/jessfraz/shaking-finger-action

on pull_request, will the action result show up if somebody with forked repo opens a PR to my repository? Typically I'd like unit tests + linting results to show in the PR automatically.

If it runs against the forked repo, then I assume it is not possible to use the GITHUB_TOKEN to post a comment like in the shaking-finger-action example?