World C4: Pipeline Shields

pull_request_target and forks

You will learn: why fork PRs get no secrets, and the trap in pull_request_target.

Checked with GitHub Actions 2026-10 on 31 Oct 2026

The problem

A stranger forks your shop repo and opens a PR. Your preview job needs your Cloudflare token. Should their code get it?

Try it

Run both events. Find the one where the preview stops.

Try the events. Find the one asked for.

What happened on GitHub

Pull requestPull request from a fork

Workflow file .github/workflows/preview.yml

1name: Preview
2on:
3  pull_request:
4permissions:
5  contents: read
6jobs:
7  preview:
8    runs-on: ubuntu-latest
9    steps:
10      - uses: actions/checkout@v7
11      - run: npm ci
12      - run: npx wrangler deploy --env preview
13        env:
14          CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}

The line

Pull request · feature → main

Watch

Some teams want previews for forks too. So they switch to . It runs with your secrets and a write key, even for forks. Sort the two triggers.

Drag a card into a box. Or tap the card, then tap the box.

Predict

This preview switches to pull_request_target. It also checks out the PR’s own code. A stranger’s fork PR arrives. What happens?

Watch

Pick an event. Press Run and watch the line.

A stranger's PR on pull_request_target. Every station turns green, with your token in the job.

What happened on GitHub

Pull request from a fork

Workflow file .github/workflows/preview.yml

1name: Preview
2on:
3  pull_request_target:
4permissions:
5  contents: read
6jobs:
7  preview:
8    runs-on: ubuntu-latest
9    steps:
10      - uses: actions/checkout@v7
11        with:
12          ref: ${{ github.event.pull_request.head.sha }}
13      - run: npm ci
14      - run: npx wrangler deploy --env preview
15        env:
16          CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}

The line

Pull request from a fork · stranger:feature → main

Green! The stranger’s npm ci ran with your token in reach. One sneaky install script could copy it.

Try it

Tap the two lines that turn this workflow into a trap.

Tap every risky line. Each one shows the attack and the fix.

Workflow file .github/workflows/welcome.yml

Check

Fine on pull_request_target, or a trap? Swipe each job.

Swipe right for good, left for needs work. Or use the buttons.

1 / 4

Add a label to a fork PR, without checking out its code

You did it!

You can now keep a stranger’s PR away from your keys.

Go deeper (optional)

Safer pattern: test fork code with pull_request. Need secrets afterwards? Use a separate workflow on workflow_run, and treat its artifacts as untrusted. First-time contributors may need a maintainer to approve their runs. Real rep: search your repos for pull_request_target and check each one.