I found a solution (which isn’t mentioned in the docs anywhere):

curl -s -X DELETE -u username:${{secrets.GITHUB_TOKEN}} https://api.github.com/repos/${{ github.repository }}/git/refs/heads/${{ github.head_ref }}

Branches are references to a commit. The documentation you seek is called Delete a reference.

Here is some more information on Git references.

Actually my solution was correct. I had only one stupid problem: the authorized user was no collaborator on my fork and thus not allowed to delete the branch. IMHO this should be added to the documentation, because it says it only gives 404 error if the refs is not found.

You can use the PATCH /repos/{owner}/{repo} endpoint (Update a repository). The delete_branch_on_merge parameter is what you are looking for.

Does that work for you?

If you created the token you're using through the Applications page, then this token will have these scopes: user, public_repo, repo, gist. You can verify this by making an API request with that token and looking at the response HTTP headers:

curl -v -H 'Authorization: token xxx' https://api.github.com

Look for the X-OAuth-Scopes response header which will have the list of scopes:

X-OAuth-Scopes: user, public_repo, repo, gist

However, to delete a repository, the token needs to have the delete_repo scope.

So, you need a token that has different scopes than the one you have. You can create such a token using the Authorizations API:

curl -v -u username -X POST https://api.github.com/authorizations -d '{"scopes":["delete_repo"], "note":"token with delete repo scope"}'

This will return a JSON document with the new token which you should be able to use to delete a repository:

{
  "id": XXXXX,
  "url": "https://api.github.com/authorizations/XXXXX",
  "app": {
    "name": "GitHub API",
    "url": "http://developer.github.com/v3/oauth/#oauth-authorizations-api",
    "client_id": "00000000000000000000"
  },
  "token": "XXXXXX",
  "note": "token with delete repo scope",
  "note_url": null,
  "created_at": "2013-10-11T20:34:49Z",
  "updated_at": "2013-10-11T20:34:49Z",
  "scopes": [
    "delete_repo"
  ]
}

Of course, when creating a token this way, you can ask for multiple scopes, not just the delete_repo scope.

Also, as a side-note, the reason why the API is returning a 404 error when you don't have the right authorization is to prevent information leakage.