Coverage doesn't run on pull requests

[countvajhula]

It appears that the Coverage step in the CI workflow fails when run on a pull request on any fork other than drym-org , with the following error:

curl: (22) The requested URL returned error: 422 
coveralls: request to coveralls failed
  context...:
   /home/runner/.local/share/racket/8.5/pkgs/cover-lib/cover/raco.rkt:95:3
   /usr/share/racket/collects/racket/logging.rkt:43:0: with-intercepted-logging
   body of (submod "/home/runner/.local/share/racket/8.5/pkgs/cover-lib/cover/raco.rkt" main)
   /usr/share/racket/collects/raco/raco.rkt:41:0
   body of "/usr/share/racket/collects/raco/raco.rkt"
   body of "/usr/share/racket/collects/raco/main.rkt"

E.g. see this workflow log.

My guess is that it has something to do with the COVERALLS_REPO_TOKEN secret which is part of the test-env environment that's used by CI. ~This is the same environment that is used on all commits, so I'm not sure why the secret would be present only when running CI on @countvajhula commits vs someone else's commits.~

~It might be related to https://github.com/lemurheavy/coveralls-public/issues/1435 .~

UPDATE: The repo settings page on GitHub at Settings -> Secrets -> Actions, says this: "Secrets are not passed to workflows that are triggered by a pull request from a fork. Learn more." I didn't see any elaborations of this in the "learn more" link.