{
  "id": "cicd/github-actions-secret-missing-org",
  "signature": "Error: Secret MY_ORG_SECRET is not set or is empty. Organization secrets are not available to forks.",
  "signature_zh": "错误：组织机密 MY_ORG_SECRET 未设置或为空。组织机密不适用于复刻仓库。",
  "regex": "Secret .* is not set or is empty\\. Organization secrets are not available to forks\\.",
  "domain": "cicd",
  "category": "auth_error",
  "subcategory": null,
  "root_cause": "GitHub Actions workflow attempts to access an organization-level secret from a forked repository, which is blocked by GitHub's security policy to prevent exposing secrets to external contributors.",
  "root_cause_type": "generic",
  "root_cause_zh": "GitHub Actions 工作流尝试从复刻仓库访问组织级机密，但 GitHub 安全策略禁止此操作，以防止机密泄露给外部贡献者。",
  "versions": [
    {
      "version": "GitHub Actions hosted runners (ubuntu-22.04, ubuntu-24.04)",
      "introduced": null,
      "deprecated": null,
      "removed": null,
      "behavior_change": null,
      "status": "active"
    },
    {
      "version": "GitHub Enterprise Server 3.8+",
      "introduced": null,
      "deprecated": null,
      "removed": null,
      "behavior_change": null,
      "status": "active"
    }
  ],
  "os_specific": {},
  "dead_ends": [
    {
      "action": "",
      "why_fails": "Adding the secret as a repository-level secret on the fork does not work because the original workflow references the organization-level secret name and the fork cannot see it.",
      "fail_rate": 0.85,
      "condition": "",
      "sources": []
    },
    {
      "action": "",
      "why_fails": "Changing the workflow to use `env:` instead of `secrets:` does not resolve the issue as the secret value is still required and must come from a context that the fork cannot access.",
      "fail_rate": 0.7,
      "condition": "",
      "sources": []
    }
  ],
  "workarounds": [
    {
      "action": "Use `pull_request_target` trigger instead of `pull_request` to run the workflow in the context of the base repository, which has access to organization secrets. Example: `on: pull_request_target: types: [opened, synchronize]`",
      "success_rate": 0.85,
      "how": "Use `pull_request_target` trigger instead of `pull_request` to run the workflow in the context of the base repository, which has access to organization secrets. Example: `on: pull_request_target: types: [opened, synchronize]`",
      "condition": "",
      "sources": []
    },
    {
      "action": "Store the secret as a repository-level secret on the original repository and use a conditional step to skip it for forks: `if: github.event.pull_request.head.repo.fork == false`",
      "success_rate": 0.75,
      "how": "Store the secret as a repository-level secret on the original repository and use a conditional step to skip it for forks: `if: github.event.pull_request.head.repo.fork == false`",
      "condition": "",
      "sources": []
    }
  ],
  "workarounds_zh": [
    "Use `pull_request_target` trigger instead of `pull_request` to run the workflow in the context of the base repository, which has access to organization secrets. Example: `on: pull_request_target: types: [opened, synchronize]`",
    "Store the secret as a repository-level secret on the original repository and use a conditional step to skip it for forks: `if: github.event.pull_request.head.repo.fork == false`"
  ],
  "transition_graph": {
    "leads_to": [],
    "preceded_by": [],
    "frequently_confused_with": []
  },
  "official_doc_url": "https://docs.github.com/en/actions/security-guides/using-secrets-in-github-actions#using-secrets-in-a-workflow",
  "official_doc_section": null,
  "error_code": "GHA_SECRET_FORK",
  "verification_tier": "ai_generated",
  "confidence": 0.88,
  "fix_success_rate": 0.8,
  "resolvable": "partial",
  "first_seen": "2023-11-15",
  "last_confirmed": "2024-06-01",
  "last_updated": "2024-06-01",
  "evidence_count": 1,
  "tags": [],
  "locale": "en",
  "aliases": []
}