workflow with manual dispatch and secret in environment - needs to be run manually - only works after committed to default branch

testsecret.yml

# So you don't pull your hair out, workflow dispatches must be in the default branch.
name: Secret Test
on:
  workflow_dispatch:
    push:
      branches:
        - master
    pull_request:
      types: [opened, synchronize, reopened] 
jobs:
  Secret-Test:
    environment: test_environment
    permissions:
      statuses: write
    runs-on: ubuntu-latest
    env:
      GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
    steps:
    - uses: actions/checkout@v4
      with:
        ref: ${{ github.event.pull_request.head.sha }}
        submodules: recursive
    - name: Install more dependencies
      run: |
        sudo apt-get install -y \
          make \
          build-essential
    - name: Build
      env:
        TEST_SECRET: ${{ secrets.TEST_SECRET }}
      run: make secrettest