fix check_secrets, expect failure

Author: ncooke3

.github/workflows/_build.yml

@@ -84,7 +84,8 @@ jobs:
     env:
       SANITIZERS: ${{ inputs.sanitizers }}
       plist_secret: ${{ secrets.plist_secret }}
-      HAVE_SECRETS: ${{ needs.check_secrets.outputs.has_secrets }}
+      FIREBASECI_SECRETS_PRESENT: ${{ needs.check_secrets.outputs.has_secrets }}
+      FIREBASECI_IS_TRUSTED_ENV: ${{ github.repository == 'firebase/firebase-ios-sdk' && (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository) }}
       FIREBASECI_USE_LATEST_GOOGLEAPPMEASUREMENT: 1
     steps:
     - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1

scripts/check_secrets.sh

@@ -22,18 +22,22 @@ echo "GITHUB_HEAD_REF: ${GITHUB_HEAD_REF:-}"
 
 check_secrets()
 {
-  # 1. Prioritize explicit workflow signal (HAVE_SECRETS).
-  #    - If set, use its value (true or false).
-  if [[ -n "${HAVE_SECRETS:-}" ]]; then
-    if [[ "$HAVE_SECRETS" == "true" ]]; then
-      return 0 # Workflow says: Secrets ARE available.
+  # 1. Prioritize explicit workflow signal (FIREBASECI_SECRETS_PRESENT).
+  if [[ -n "${FIREBASECI_SECRETS_PRESENT:-}" ]]; then
+    if [[ "$FIREBASECI_SECRETS_PRESENT" == "true" ]]; then
+      return 0 # Workflow says: Secrets ARE available. Proceed.
     else
-      return 1 # Workflow says: Secrets are NOT available.
+      # Workflow says: Secrets are NOT available.
+      if [[ "$FIREBASECI_IS_TRUSTED_ENV" == "true" ]]; then
+        return 0 # Secrets not provided on main repo. Proceed (fail if secrets are actually needed).
+      else
+        return 1 # We don't expect secrets (e.g., fork PR). Skip gracefully.
+      fi
     fi
   fi
 
   # 2. Fallback for un-migrated/legacy workflows: assume secrets if in GHA.
-  #    - This maintains original behavior for workflows not yet updated with HAVE_SECRETS.
+  #    - This maintains original behavior for workflows not yet updated with FIREBASECI_SECRETS_PRESENT.
   if [[ -n "${GITHUB_WORKFLOW:-}" ]]; then
     return 0 # Assume secrets if running in GHA (legacy behavior).
   fi