fork-pull: site-admin is allowed to all actinos