@orta do you think a new GitHub API token can be generated and added as GitHub Actions secret for https://github.com/danger-public?

Afraid not, needs to be in the code like above, secrets wont work here because it only runs on branch PRs and not forks

Ah, you probably broke the old token by putting it in a single string too, will need to find the password for that account

The token is not authorized anymore, if my change deauthorized the token sorry about that.
Indeed storing it as GitHub Actions secrets, will make it not available for fork PRs, but I'm not sure splitting the token in 2 parts, is the best workaround to use in terms of security.

Actually, GitHub advises solving the problem differently: https://github.blog/2020-08-03-github-actions-improvements-for-fork-and-pull-request-workflows.

I'll test that in this PR.

Unfortunately using pull_request_target or workflow_run triggers will not work out of the box. Indeed, the workflow will be executed in the context of the base branch, not of the head branch / PR context.

Using env var this way works, but it will not work for forked pull requests:

env:
  DANGER_GITHUB_API_TOKEN: ${{ secrets.GITHUB_TOKEN }}

secrets cannot be accessed by forked PRs, so this change isn't doing what you want it to do I think