# Error: Secret MY_ORG_SECRET is not set or is empty. Organization secrets are not available to forks.

- **ID:** `cicd/github-actions-secret-missing-org`
- **Domain:** cicd
- **Category:** auth_error
- **Error Code:** `GHA_SECRET_FORK`
- **Verification:** ai_generated
- **Fix Rate:** 80%

## Root Cause

GitHub Actions workflow attempts to access an organization-level secret from a forked repository, which is blocked by GitHub's security policy to prevent exposing secrets to external contributors.

## Version Compatibility

| Version | Status | Introduced | Deprecated |
|---------|--------|------------|------------|
| GitHub Actions hosted runners (ubuntu-22.04, ubuntu-24.04) | active | — | — |
| GitHub Enterprise Server 3.8+ | active | — | — |

## Workarounds

1. **Use `pull_request_target` trigger instead of `pull_request` to run the workflow in the context of the base repository, which has access to organization secrets. Example: `on: pull_request_target: types: [opened, synchronize]`** (85% success)
   ```
   Use `pull_request_target` trigger instead of `pull_request` to run the workflow in the context of the base repository, which has access to organization secrets. Example: `on: pull_request_target: types: [opened, synchronize]`
   ```
2. **Store the secret as a repository-level secret on the original repository and use a conditional step to skip it for forks: `if: github.event.pull_request.head.repo.fork == false`** (75% success)
   ```
   Store the secret as a repository-level secret on the original repository and use a conditional step to skip it for forks: `if: github.event.pull_request.head.repo.fork == false`
   ```

## Dead Ends

- **** — Adding the secret as a repository-level secret on the fork does not work because the original workflow references the organization-level secret name and the fork cannot see it. (85% fail)
- **** — Changing the workflow to use `env:` instead of `secrets:` does not resolve the issue as the secret value is still required and must come from a context that the fork cannot access. (70% fail)