Travis CI & GitHub: Interoperability of Build Status Reporting for Fork Pull Requests

When a pull request originates from a fork, Travis CI must decide which .travis.yml to run, whether to expose secure environment variables, and how to report the resulting status back to GitHub. The .travis.yml is taken from the head branch of the pull request, which allows a malicious fork to alter build steps while secrets remain hidden. However, the exact conditions under which secure variables are withheld differ between Travis account types and depend on the GitHub App or OAuth installation used for the integration.

Additionally, the timing of the status update on GitHub is not fixed; it can vary based on Travis queue position, worker availability, and the repository’s merge‑gate configuration. Because the status propagation latency is not guaranteed, teams cannot rely on it as a deterministic gate in their CI/CD workflow.

Given these uncertainties, the following decisions remain unresolved:

• Under what repository or account settings does Travis include secure environment variables in a fork pull‑request build?
• How does Travis select the .travis.yml file when a fork introduces a conflicting configuration?
• What is the typical latency between build completion on Travis and the commit status appearing on GitHub for fork pull requests?