ci: replace pull_request_target fork CI with rotating public token

.github/workflows/android-actions.yml

@@ -7,9 +7,6 @@ on:
         required: true
         default: default
         type: string
-      ref:
-        required: false
-        type: string 
       NVMRC:
         required: true
         type: string
@@ -37,13 +34,6 @@ jobs:
     steps:
       - name: Checkout
         uses: actions/checkout@v4
-        if: ${{ inputs.ref == '' }}
-
-      - name: Checkout fork
-        uses: actions/checkout@v4
-        if: ${{ inputs.ref != '' }}
-        with:
-          ref: ${{ inputs.ref }}
 
       - name: Setup node ${{ inputs.NVMRC }}
         uses: actions/setup-node@v3.5.1
@@ -57,7 +47,14 @@ jobs:
           java-version: '17'
 
 
-      - run: echo $MAPBOX_ACCESS_TOKEN > ./accesstoken
+      # Fork PRs get no secrets; fall back to the public rotated CI token (see rnmapbox/ci-config)
+      - name: Access token
+        run: |
+          if [ -n "$MAPBOX_ACCESS_TOKEN" ]; then
+            echo "$MAPBOX_ACCESS_TOKEN" > ./accesstoken
+          else
+            "$GITHUB_WORKSPACE/scripts/ci/fetch-mapbox-token.sh" > ./accesstoken
+          fi
         working-directory: example
         env:
           MAPBOX_ACCESS_TOKEN: ${{ secrets.MAPBOX_ACCESS_TOKEN || secrets.ENV_MAPBOX_ACCESS_TOKEN }}

.github/workflows/ci-requiring-tokens.yml

@@ -10,9 +10,6 @@ on:
         required: false
         type: string
         default: default
-      ref:
-        required: false
-        type: string
     secrets:
       MAPBOX_ACCESS_TOKEN:
         required: false
@@ -32,7 +29,6 @@ jobs:
     uses: ./.github/workflows/android-actions.yml
     with:
       env_name: ${{ inputs.env_name }}
-      ref: ${{ inputs.ref }}
       NVMRC: ${{ inputs.NVMRC }}
       MAP_IMPL: mapbox11
       NEW_ARCH: true
@@ -45,7 +41,6 @@ jobs:
     uses: ./.github/workflows/ios-actions.yml
     with:
       env_name: ${{ inputs.env_name }}
-      ref: ${{ inputs.ref }}
       NVMRC: ${{ inputs.NVMRC }}
       MAP_IMPL: mapbox11
       NEW_ARCH: true
@@ -58,7 +53,6 @@ jobs:
     uses: ./.github/workflows/web-actions.yml
     with:
       env_name: ${{ inputs.env_name }}
-      ref: ${{ inputs.ref }}
       NVMRC: ${{ inputs.NVMRC }}
     secrets:
       MAPBOX_ACCESS_TOKEN: ${{ secrets.MAPBOX_ACCESS_TOKEN }}

.github/workflows/ios-actions.yml

@@ -7,9 +7,6 @@ on:
         required: true
         default: default
         type: string
-      ref:
-        required: false
-        type: string
       NVMRC:
         required: true
         type: string
@@ -43,20 +40,18 @@ jobs:
     steps:
       - name: Checkout
         uses: actions/checkout@v4
-        if: ${{ inputs.ref == '' }}
-
-      - name: Checkout fork
-        uses: actions/checkout@v4
-        if: ${{ inputs.ref != '' }}
-        with:
-          ref: ${{ inputs.ref }}
 
+      # Fork PRs get no secrets; fall back to the public rotated CI token (see rnmapbox/ci-config)
       - name: Access Token
-        run: echo $MAPBOX_ACCESS_TOKEN > ./accesstoken
+        run: |
+          if [ -n "$MAPBOX_ACCESS_TOKEN" ]; then
+            echo "$MAPBOX_ACCESS_TOKEN" > ./accesstoken
+          else
+            "$GITHUB_WORKSPACE/scripts/ci/fetch-mapbox-token.sh" > ./accesstoken
+          fi
         env:
           MAPBOX_ACCESS_TOKEN: ${{ secrets.MAPBOX_ACCESS_TOKEN || secrets.ENV_MAPBOX_ACCESS_TOKEN }}
 
-
       - name: Setup node ${{ inputs.NVMRC }}
         uses: actions/setup-node@v3.5.1
         with:

.github/workflows/on-push.yml

@@ -74,7 +74,9 @@ jobs:
     uses: ./.github/workflows/ci-requiring-tokens.yml
     with:
       NVMRC: ${{ needs.lint_test_generate.outputs.NVMRC }}
-    if: needs.has_mapbox_token.outputs.has-mapbox-token == 'true'
+    # Fork PRs have no secrets but can still build with the public rotated CI token,
+    # so always run in rnmapbox/maps; forks of the repo still need their own token.
+    if: needs.has_mapbox_token.outputs.has-mapbox-token == 'true' || github.repository == 'rnmapbox/maps'
     secrets:
       MAPBOX_ACCESS_TOKEN: ${{ secrets.MAPBOX_ACCESS_TOKEN }}
 

.github/workflows/web-actions.yml

@@ -7,9 +7,6 @@ on:
         required: true
         default: default
         type: string
-      ref:
-        required: false
-        type: string
       NVMRC:
         required: true
         type: string
@@ -27,20 +24,20 @@ jobs:
     steps:
       - name: Checkout
         uses: actions/checkout@v4
-        if: ${{ inputs.ref == '' }}
-
-      - name: Checkout fork
-        uses: actions/checkout@v4
-        if: ${{ inputs.ref != '' }}
-        with:
-          ref: ${{ inputs.ref }}
 
       - name: Setup node ${{ inputs.NVMRC }}
         uses: actions/setup-node@v3.5.1
         with:
           node-version: ${{ inputs.NVMRC }}
 
-      - run: echo $MAPBOX_ACCESS_TOKEN > ./accesstoken
+      # Fork PRs get no secrets; fall back to the public rotated CI token (see rnmapbox/ci-config)
+      - name: Access token
+        run: |
+          if [ -n "$MAPBOX_ACCESS_TOKEN" ]; then
+            echo "$MAPBOX_ACCESS_TOKEN" > ./accesstoken
+          else
+            "$GITHUB_WORKSPACE/scripts/ci/fetch-mapbox-token.sh" > ./accesstoken
+          fi
         working-directory: example
         env:
           MAPBOX_ACCESS_TOKEN: ${{ secrets.MAPBOX_ACCESS_TOKEN || secrets.ENV_MAPBOX_ACCESS_TOKEN }}

scripts/ci/fetch-mapbox-token.sh

@@ -0,0 +1,11 @@
+#!/bin/sh
+# Fetches the Mapbox access token used by CI for fork PRs (no secrets there).
+# The token is public by design — obfuscation only defeats token scrapers /
+# secret scanning; rotation (2x/week, see rnmapbox/ci-config) is the real defense.
+# -md sha256 instead of -pbkdf2 for LibreSSL compat on macOS runners.
+set -eu
+
+URL="https://raw.githubusercontent.com/rnmapbox/ci-config/main/mapbox-ci-token.v1.enc"
+OBFUSCATION_KEY="93b0fa94d67b3e1a5f2e59d920bc4854"
+
+curl -fsSL "$URL" | openssl enc -d -aes-256-cbc -base64 -A -md sha256 -k "$OBFUSCATION_KEY"