I’d like to confirm a question about PR

[liby]

I saw #339 and #497, and noticed this comment-639546151

OK. I will enhance our warning message when this action runs on a forked repo. All users do not know the spec of GitHub Actions' secrets.
I'm very sorry for taking a long time for this. As a long-service user, I should have noticed your event triggered by a forked repo at first...

My current approach is to skip jobs that require GITHUB_TOKEN via if: ${{ github.ref == 'refs/heads/main' }}, I see the same code in the repository example.

Although I haven't found the exact documentation, I'm basically sure now that the forked repositories don't read GITHUB_TOKEN when submitting a PR. But I see that you quote this sentence:

With the exception of GITHUB_TOKEN, secrets are not passed to the runner when a workflow is triggered from a forked repository.

If I understand correctly: the forked repository is able to read GITHUB_TOKEN. I searched the official documentation for this, but I couldn't find any instructions on setting up the forked repository to be allowed to read GITHUB_TOKEN.

The only thing relevant is the permissions configuration, but after I set

permissions:
  pull-requests: read

I still get error. I also found the original text of the above quote:

With the exception of GITHUB_TOKEN, secrets are not passed to the runner when a workflow is triggered from a forked repository. The permissions for the GITHUB_TOKEN in forked repositories is read-only. For more information, see "Authenticating with the GITHUB_TOKEN."

If The permissions for the GITHUB_TOKEN in forked repositories is read-only., then why does this error still occur?

So I'd like to get a more detailed answer from you, or maybe an official statement that the forked repository doesn't allow readingGITHUB_TOKEN related documents, I know this question is a bit off-topic, but I really don't have a choice because I don't know where to get the answer at the moment.

I look forward to hearing from you, have a great day.

[peaceiris]

You just forgot the write permission for contents.

permissions:
+ contents: write
  pull-requests: read

[liby]

The generated GITHUB_TOKEN with the pull_request event from a FORK repository does not have any write permission.
That is the reason the pull_request event from a FORK repository needs the if: ${{ github.ref == 'refs/heads/main' }} filter.

So in my case, the GITHUB_TOKEN generated by the forked repository will only be rejected by the main repository. Therefore, this job can only be skipped, right?

If you want to deploy from only a default branch and use the pull_request event, please add the filter.

Not fully understood. Are there examples or simple code?

[peaceiris]

Yes.

[liby]

Something like this?

if: ${{github.event_name == 'pull_request' && github.ref == 'refs/heads/master'}}

[peaceiris]

I think the if: ${{ github.ref == 'refs/heads/main' }} filter which is mentioned on the README will satisfy demand of the project.

[liby]

Oh, it's really enough to meet my needs.

I just took the following passage as a test question:

If you want to deploy from only a default branch and use the pull_request event, please add the filter.

and tried to solve it.