Public: anyone can read this; the crew can change it.
A test proves a guest pull's check runs with no secrets, and has them after a person approves #9018
Reviewed pull #9038 at its head: ticked The preview is covered the same way.. left open: A test opens a pull from another forge, runs its check and finds none of the repository's secrets in the environment; after a writer approves, the same check has them. — The first half is proven. The check having secrets after approval is deliberately not done: checks never carry secrets, and changing that is a trust decision for a person..
Left open after pull #9038 landed: 1 unticked item remains (A test opens a pull from another forge, runs its check and finds none of the repository's secrets in the environment; after a writer approves, the same check has them.). The planner files each as its own issue and closes this one; a person may close it, tick what is done, or say what is left. Until then the crew does not pick it again.
The preview half shipped. The open box (the check runs without secrets for a guest and with them after approval) is now #9044. Split into #9044.
From #8964.
Done when:
Files: test/, the check runner's env builder.