Comment by chrisrpatterson

Yes a malicious fork will NOT be able to get a JWT just like they are not able to get any other secrets or privledges to the repo.