doxa-life/doxa-maps
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Contributor tutorial: run pull-request checks for contributor branches without repository secrets

Browse source
This commit is contained in:
Doxa Maps 2026-10-05 15:02:27 +00:00
parent db472a92df
commit ff9ab27f75
1 changed files with 2 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
documentation/contribute/TUTORIAL.md
View file

@ -38,6 +38,8 @@ If the push step fails with a permission error, check **Settings → Actions →
**Pull requests → New pull request**, base: your main branch, compare: `contributor`. Review it like any outside contribution, and merge when you're happy. If the pull request stays open, it updates itself each time the Action brings new commits.
**Keep your secrets out of its CI.** A pull request from a branch in your own repo (unlike one from a fork) runs your `pull_request` workflows **with your repository secrets**, and those runs execute the contributor's code. The guard stops changes to your workflows, not code running inside them. So for `contributor` pull requests, run checks that need no secrets, and keep secret-using steps in `push` or `workflow_dispatch` jobs, or behind a protected environment with required reviewers.
## Good to know
- **Turn it off:** delete the file, or use **Actions → Pull contributor → ⋯ → Disable workflow**.