Fix GitHub Actions Secret Not Available in Fork Pull Request

GitHub does not expose repository secrets to untrusted fork pull requests by default. Design workflows so deploy steps only run on trusted branches.

Book $50 Deploy Rescue Generate a checklist

Common symptoms

Workflow fails only on external pull requests.
Logs show empty token or missing secret.
Deploy job runs for PRs from forks.

What to check first

Platform: GitHub Actions
Error: Secret not available

GitHub does not expose repository secrets to untrusted fork pull requests by default. Design workflows so deploy steps only run on trusted branches.

Step-by-step fix

Restrict deploy jobs to push events or trusted branches.
Separate test jobs from deploy jobs.
Use environments and required reviewers for sensitive deployments.
Document that fork PRs cannot run secret-backed deploys.

if: github.event_name == "push" && github.ref == "refs/heads/main"

Common mistake to avoid

Do not use pull_request_target with untrusted code unless you fully understand the security risk.

Still stuck?

Send the deploy log, repository link, target platform, and expected URL. ShipFast Deploy Rescue is a fixed-price debugging service for indie projects and MVPs.

Get Deploy Rescue Email project details