How does GitHub handle pull requests from forked repositories in terms of Actions security?

Question

Github — Hard

How does GitHub handle pull requests from forked repositories in terms of Actions security?

Accepted Answer

GitHub handles pull requests from forked repositories by limiting workflow permissions. The correct approach restricts GITHUB_TOKEN permissions to read-only, preventing access to repository secrets. Incorrect options, such as identical permissions or blocking all GitHub Actions, do not accurately reflect GitHub's security measures.