Provide guidance for how to handle secrets and forks from PRs.

[2color]

Problem

When a pull request is created from a fork and the workflow runs (via the pull_request event, it has no access to the secrets of the base repository. This is sensible for security, but there might be situations where you want to allow the pull request to run, for example after reviewing it and confirming it has no malicious changes.

Example PR: ipfs/ipfs-blog#707

What should we do?

We should document how to deal with this case in the README.md with all the risks invovled. Since this action doesn't make any assumptions or dictate your workflow, it's ultimately up to users of this actions to decide how to use it.

It may be possible to use the pull_request_target event for this purpose.

[2color]

Update: ipfs/ipfs-blog#711 looks into this.

Once we make a decision, I'll document.