I'm trying to create an action which will invite a contributor whos PR gets merged, to an organization.
I have almost finished it, but I have a pretty annoying problem now because workflow triggered by a PR merged to the main repo from the user's repository doesn't have access to the secrets, and I need a secret(public access token) to provide it to the GitHub API to invite a user.
How could one solve this?
Thanks for your feedback! It's not supported, please check below:
1. With the exception of GITHUB_TOKEN, secrets are not passed to the runner when a workflow is triggered from a forked repository. Link below：
2. In the workflow which triggered by pull request from forked repo, 'secrets.GITHUB_TOKEN' has only 'read' permission, it is lack of permission to be used in API to invite users. Link below:
You can try to use push event to trigger a workflow in your repository, and then in the action you can parse the detailed information about the push and try to invite the user if it is a merge commit from other repos.