Fork PRs can't access repo secrets with pull_request trigger. pull_request_target runs in the base repo context so Cloudflare secrets are available for all PRs.