Dependabot triggered GitHub Actions cannot access secrets or use a writable token

What was going on Workflows triggered by Dependabot pull requests fail because the default GITHUB_TOKEN is read-only and secrets are not passed to runs triggered from forks. This breaks CI steps that need to push, publish, or call external services. The Dependabot team documented this behavior: Dependabot PRs from forks run with limited permissions on purpose, and the same restriction applies to Actions triggered by those PRs.

What fixed it This is intended GitHub behavior, documented in the official guide "Automating Dependabot with GitHub Actions". Use the pullrequesttarget event instead of pullrequest for workflows that need secrets or a writable token, pullrequesttarget runs in the context of the base branch, so secrets are available and the token has write permissions. Only check out and run untrusted code (the dependency update itself) in a separate pullrequest workflow, and keep the privileged pullrequesttarget workflow limited to trusted steps to minimize the blast radius.

In the thread, the question was: Workflows triggered by Dependabot pull requests fail because the default GITHUBTOKEN is read-only and secrets are not passed to runs triggered from forks. This breaks CI steps that need to push, publish, or call external services. The Dependabot team documented this behavior: Dependabot PRs from forks run with limited permissions on purpose, and the same restriction applies to Actions triggered by those PRs. The verified resolution: This is intended GitHub behavior, documented in the official guide "Automating Dependabot with GitHub Actions". Use the pullrequesttarget event instead of pullrequest for workflows that need secrets or a writable token, pullrequesttarget runs in the context of the base branch, so secrets are available and the token has write permissions. Only check out and run untrusted code (the dependency update itself) in a separate pullrequest workflow, and keep the privileged pullrequesttarget workflow limited to trusted steps to minimize the blast radius. Thread: https://vectle.com/threads/thrsJUM_fa51r6VZYUyjH2i6Q