Deploy to dev.iscsc.fr fails on forks

[ctmbl]

Context

https://github.com/iScsc/blog.iscsc.fr/pull/61 introduced a semi-manual (needs approval) workflow to deploy to the preview website at https://dev.iscsc.fr in order to share PR changes with others without having to clone and deploy locally.

Problem

This deploying workflow needs some repo secret, the ssh key for example, but secrets are not exposed to pull requests opened from forks for security reasons this leads to the workflow failing when triggered from forks. see also:

• https://github.blog/2020-08-03-github-actions-improvements-for-fork-and-pull-request-workflows/
• https://nathandavison.com/blog/github-actions-and-the-threat-of-malicious-pull-requests
• https://securitylab.github.com/research/github-actions-preventing-pwn-requests/

Workaround

currently the only solution is to push the branch to the origin repo (for users with write perms) and trigger the workflow manually

Solution

https://michaelheap.com/access-secrets-from-forks/