on:
  pull:
    base: [refs/heads/main]
image: alpine:3.20
secrets: [DEMO]
steps:
  - name: no-secret
    run: test -z "$DEMO" && echo "pull has no secret"