Merge pipelines and pull request pipelines often run under different security rules, even though the code is the same.

Many CI systems restrict secrets, credentials, or cloud access depending on how the pipeline was triggered. A pipeline running on a merge to the main branch might use a different identity, environment, or permission set than one running on a pull request.

This makes failures feel inconsistent, but the difference is usually intentional from a security perspective.

Takeaway: When CI behaves differently, compare identities and secrets—not code changes.