secrets not available in pull requests from forks CI/CD Origin: Build & delivery Last updated 25 Oct 2026

GitHub Actions: secret is empty on pull_request from a fork or Dependabot (Secrets are not passed to workflows triggered by a fork)

Secrets are intentionally withheld from workflows that run for pull requests from forks and, by default, for Dependabot PRs — so ${{ secrets.X }} is an empty string.

Exact message you may see Secrets are not passed to workflows that are triggered by a pull request from a forksecrets are empty on pull_request from forkDependabot cannot access secretssecrets not available in fork pull requestResource not accessible by integration fork
Explore the map of this error Full error map →
Seen on: GitHub Actions

Meaning

This protects your secrets from untrusted code. Steps that need a secret then fail with "Input required and not supplied" or an authentication error. Run secret-free checks on pull_request, and use pull_request_target or workflow_run only with great care (never check out and run untrusted PR code with secrets).

Common causes

  • PR opened from a fork (secrets and write token are not provided)
  • Dependabot-triggered run using Actions secrets instead of Dependabot secrets
  • Secret defined at the wrong level (environment vs repository)
  • Secret name misspelled
  • Environment protection rules not met

⚡ Quick fix

  1. Keep untrusted PR jobs secret-free (build and test only)
  2. Add the secrets under Settings → Secrets → Dependabot for Dependabot PRs
  3. Use workflow_run / pull_request_target with a hardened design if you must comment or publish

Detailed fix by platform

GitHub Actions

  1. Fork-safe pattern: build on pull_request, upload an artifact, then a separate workflow_run job (with secrets) reads the artifact data but never executes it

Code examples

Skip secret steps for forks

yaml
- name: Deploy preview
  if: github.event.pull_request.head.repo.full_name == github.repository   # not from a fork
  env:
    TOKEN: ${{ secrets.PREVIEW_TOKEN }}
  run: ./preview.sh

How to diagnose

  1. Origin — Is the PR from a fork or Dependabot?
  2. Level — Where is the secret defined?
  3. Needs — Does the step really require a secret?

🔧 Still not fixed?

Many errors look alike. If the steps above didn’t solve it, one of these is probably what you’re facing:

Where this error sits

Origin: Build & delivery. Errors that are often confused with or caused by this one (click to open):

API rate limit exceeded — GitHub Actions: HttpError: API rate limit exceeded for installation ID 123456 / secondary rate limit (CI/CD)API rate limit exceed…Context access might be invalid — GitHub Actions: Context access might be invalid: AWS_ACCESS_KEY_ID (editor warning for secrets/vars) (CI/CD)Context access might …Credentials could not be loaded — GitHub Actions: Error: Credentials could not be loaded, please check your action inputs: Could not load credentials from any providers (CI/CD)Credentials could not…Input required and not supplied — GitHub Actions: Error: Input required and not supplied: token (CI/CD)Input required and no…Resource not accessible by integration — GitHub Actions: Error: Resource not accessible by integration (403) (CI/CD)Resource not accessib…Unable to download artifact — GitHub Actions: Error: Unable to download artifact(s): Artifact not found for name: build (CI/CD)Unable to download ar…Unable to get ACTIONS_ID_TOKEN_REQUEST_URL — GitHub Actions: Error: Unable to get ACTIONS_ID_TOKEN_REQUEST_URL env variable (CI/CD)Unable to get ACTIONS…workflow not triggering — GitHub Actions: workflow does not run on push / pull_request / workflow_dispatch button missing (CI/CD)workflow not triggeri…secrets n…

Explore the map of this error Full error map →

🧠 Still stuck? Analyze your error

Paste the full message, response headers or stack trace — we'll detect the platform and point to the most likely cause.

💬 What worked for others

No tips yet — did something else fix this for you?

Share what worked for you

Tips are checked by an editor before they appear. Links are removed.