Include the GITHUB_TOKEN/GITEA_TOKEN secret for fork pull requests (#26759) (#26806)

Backport #26759

Co-authored-by: Jason Song <i@wolfogre.com>

diff --git a/routers/api/actions/runner/utils.go b/routers/api/actions/runner/utils.go
index 7c9171329e5e295150233ce9a84c7a0edc90104d..784f36bd13574d979c8eb62c32e11ce87b27de7a 100644 (file)
--- a/routers/api/actions/runner/utils.go
+++ b/routers/api/actions/runner/utils.go
@@ -53,8 +53,12 @@ func pickTask(ctx context.Context, runner *actions_model.ActionRunner) (*runnerv
 
 func getSecretsOfTask(ctx context.Context, task *actions_model.ActionTask) map[string]string {
        secrets := map[string]string{}
+
+       secrets["GITHUB_TOKEN"] = task.Token
+       secrets["GITEA_TOKEN"] = task.Token
+
        if task.Job.Run.IsForkPullRequest {
-               // ignore secrets for fork pull request
+               // ignore secrets for fork pull request, except GITHUB_TOKEN and GITEA_TOKEN which are automatically generated.
                return secrets
        }
 
@@ -78,13 +82,6 @@ func getSecretsOfTask(ctx context.Context, task *actions_model.ActionTask) map[s
                }
        }
 
-       if _, ok := secrets["GITHUB_TOKEN"]; !ok {
-               secrets["GITHUB_TOKEN"] = task.Token
-       }
-       if _, ok := secrets["GITEA_TOKEN"]; !ok {
-               secrets["GITEA_TOKEN"] = task.Token
-       }
-
        return secrets
 }