Workflow Anatomy and Fork PRs — quiz

on: pull_request
jobs:
  build:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - run: make test
  deploy-preview:
    needs: build
    runs-on: ubuntu-latest
    steps:
      - run: ./deploy.sh
        env:
          API_TOKEN: ${{ secrets.PREVIEW_TOKEN }}

For a pull request from a fork, build passes but deploy-preview fails because API_TOKEN is empty. PRs from branches in the same repository work. Why?