public access to a dvc-cml project?

@dmpetrov and I have been talking about how we’ll build tutorials for dvc-cml. One idea, which I’ve been building in a repo, is a project where anyone can make a fork and then submit a PR to see the workflow in action.

However, I’ve found this note on the Settings/Secrets page:

Secrets are not passed to workflows that are triggered by a pull request from a fork. Learn more.

If I understand correctly, this means that if someone in the public/outside DVC cloned our repo and attempted to make a PR, dvc repro might be triggered BUT the runner would not be able to access credentials, such as the Google Drive credentials needed to push/pull project artifacts. Does this sound correct?

If it’s an issue, seems like we could simply put the credentials in a config file in the repo- I think, with GDrive, this is often alright?

[shcheklein]

will we have to worry about secrets not being passed to workflows “triggered by a pull request from a fork”?

yes, we won’t have to worry as far as I remember … i would ask @efiop and @DavidGOrtega to double check.

[shcheklein]

It’s absolutely possible and safe to give public access to push branches I suppose in this case.

put the credentials in a config file in the repo- I think, with GDrive, this is often alright?

you mean JSON file? it means that people will have read/write access to that Drive. It’s probably fine if we create some demo account. But it’s not safe in general case.