# 错误：组织机密 MY_ORG_SECRET 未设置或为空。组织机密不适用于复刻仓库。

- **ID:** `cicd/github-actions-secret-missing-org`
- **领域:** cicd
- **类别:** auth_error
- **错误码:** `GHA_SECRET_FORK`
- **验证级别:** ai_generated
- **修复率:** 80%

## 根因

GitHub Actions 工作流尝试从复刻仓库访问组织级机密，但 GitHub 安全策略禁止此操作，以防止机密泄露给外部贡献者。

## 版本兼容性

| 版本 | 状态 | 引入 | 弃用 |
|------|------|------|------|
| GitHub Actions hosted runners (ubuntu-22.04, ubuntu-24.04) | active | — | — |
| GitHub Enterprise Server 3.8+ | active | — | — |

## 解决方案

1. ```
   Use `pull_request_target` trigger instead of `pull_request` to run the workflow in the context of the base repository, which has access to organization secrets. Example: `on: pull_request_target: types: [opened, synchronize]`
   ```
2. ```
   Store the secret as a repository-level secret on the original repository and use a conditional step to skip it for forks: `if: github.event.pull_request.head.repo.fork == false`
   ```

## 无效尝试

- **** — Adding the secret as a repository-level secret on the fork does not work because the original workflow references the organization-level secret name and the fork cannot see it. (85% 失败率)
- **** — Changing the workflow to use `env:` instead of `secrets:` does not resolve the issue as the secret value is still required and must come from a context that the fork cannot access. (70% 失败率)