[Actions - Reusable workflows] Fix secrets inherit path (#28093)
This commit is contained in:
@@ -103,11 +103,10 @@ You can define inputs and secrets, which can be passed from the caller workflow
|
|||||||
required: true
|
required: true
|
||||||
```
|
```
|
||||||
{% endraw %}
|
{% endraw %}
|
||||||
|
For details of the syntax for defining inputs and secrets, see [`on.workflow_call.inputs`](/actions/reference/workflow-syntax-for-github-actions#onworkflow_callinputs) and [`on.workflow_call.secrets`](/actions/reference/workflow-syntax-for-github-actions#onworkflow_callsecrets).
|
||||||
{% if actions-inherit-secrets-reusable-workflows %}
|
{% if actions-inherit-secrets-reusable-workflows %}
|
||||||
For details of the syntax for defining inputs and secrets, see [`on.workflow_call.inputs`](/actions/reference/workflow-syntax-for-github-actions#onworkflow_callinputs), [`on.workflow_call.secrets`](/actions/reference/workflow-syntax-for-github-actions#onworkflow_callsecrets) and [`on.workflow_call.secrets.inherit`](/actions/using-workflows/workflow-syntax-for-github-actions#onworkflow_callsecretsinherit).
|
|
||||||
1. In the reusable workflow, reference the input or secret that you defined in the `on` key in the previous step. If the secrets are inherited using `secrets: inherit`, you can reference them even if they are not defined in the `on` key.
|
1. In the reusable workflow, reference the input or secret that you defined in the `on` key in the previous step. If the secrets are inherited using `secrets: inherit`, you can reference them even if they are not defined in the `on` key.
|
||||||
{%- else %}
|
{%- else %}
|
||||||
For details of the syntax for defining inputs and secrets, see [`on.workflow_call.inputs`](/actions/reference/workflow-syntax-for-github-actions#onworkflow_callinputs) and [`on.workflow_call.secrets`](/actions/reference/workflow-syntax-for-github-actions#onworkflow_callsecrets).
|
|
||||||
1. In the reusable workflow, reference the input or secret that you defined in the `on` key in the previous step.
|
1. In the reusable workflow, reference the input or secret that you defined in the `on` key in the previous step.
|
||||||
{%- endif %}
|
{%- endif %}
|
||||||
|
|
||||||
@@ -194,7 +193,7 @@ When you call a reusable workflow, you can only use the following keywords in th
|
|||||||
* [`jobs.<job_id>.with.<input_id>`](/actions/reference/workflow-syntax-for-github-actions#jobsjob_idwithinput_id)
|
* [`jobs.<job_id>.with.<input_id>`](/actions/reference/workflow-syntax-for-github-actions#jobsjob_idwithinput_id)
|
||||||
* [`jobs.<job_id>.secrets`](/actions/reference/workflow-syntax-for-github-actions#jobsjob_idsecrets)
|
* [`jobs.<job_id>.secrets`](/actions/reference/workflow-syntax-for-github-actions#jobsjob_idsecrets)
|
||||||
* [`jobs.<job_id>.secrets.<secret_id>`](/actions/reference/workflow-syntax-for-github-actions#jobsjob_idsecretssecret_id)
|
* [`jobs.<job_id>.secrets.<secret_id>`](/actions/reference/workflow-syntax-for-github-actions#jobsjob_idsecretssecret_id)
|
||||||
{% if actions-inherit-secrets-reusable-workflows %}* [`jobs.<job_id>.secrets.inherit`](/actions/using-workflows/workflow-syntax-for-github-actions#onworkflow_callsecretsinherit){% endif %}
|
{% if actions-inherit-secrets-reusable-workflows %}* [`jobs.<job_id>.secrets.inherit`](/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idsecretsinherit){% endif %}
|
||||||
* [`jobs.<job_id>.needs`](/actions/reference/workflow-syntax-for-github-actions#jobsjob_idneeds)
|
* [`jobs.<job_id>.needs`](/actions/reference/workflow-syntax-for-github-actions#jobsjob_idneeds)
|
||||||
* [`jobs.<job_id>.if`](/actions/reference/workflow-syntax-for-github-actions#jobsjob_idif)
|
* [`jobs.<job_id>.if`](/actions/reference/workflow-syntax-for-github-actions#jobsjob_idif)
|
||||||
* [`jobs.<job_id>.permissions`](/actions/reference/workflow-syntax-for-github-actions#jobsjob_idpermissions)
|
* [`jobs.<job_id>.permissions`](/actions/reference/workflow-syntax-for-github-actions#jobsjob_idpermissions)
|
||||||
|
|||||||
@@ -157,42 +157,6 @@ jobs:
|
|||||||
```
|
```
|
||||||
{% endraw %}
|
{% endraw %}
|
||||||
|
|
||||||
{% if actions-inherit-secrets-reusable-workflows %}
|
|
||||||
|
|
||||||
#### `on.workflow_call.secrets.inherit`
|
|
||||||
|
|
||||||
Use the `inherit` keyword to pass all the calling workflow's secrets to the called workflow. This includes all secrets the calling workflow has access to, namely organization, repository, and environment secrets. The `inherit` keyword can be used to pass secrets across repositories within the same organization, or across organizations within the same enterprise.
|
|
||||||
|
|
||||||
#### Example
|
|
||||||
|
|
||||||
{% raw %}
|
|
||||||
|
|
||||||
```yaml
|
|
||||||
on:
|
|
||||||
workflow_dispatch:
|
|
||||||
|
|
||||||
jobs:
|
|
||||||
pass-secrets-to-workflow:
|
|
||||||
uses: ./.github/workflows/called-workflow.yml
|
|
||||||
secrets: inherit
|
|
||||||
```
|
|
||||||
|
|
||||||
```yaml
|
|
||||||
on:
|
|
||||||
workflow_call:
|
|
||||||
|
|
||||||
jobs:
|
|
||||||
pass-secret-to-action:
|
|
||||||
runs-on: ubuntu-latest
|
|
||||||
steps:
|
|
||||||
- name: Use a repo or org secret from the calling workflow.
|
|
||||||
run: echo ${{ secrets.CALLING_WORKFLOW_SECRET }}
|
|
||||||
```
|
|
||||||
|
|
||||||
{% endraw %}
|
|
||||||
|
|
||||||
{%endif%}
|
|
||||||
|
|
||||||
#### `on.workflow_call.secrets.<secret_id>`
|
#### `on.workflow_call.secrets.<secret_id>`
|
||||||
|
|
||||||
A string identifier to associate with the secret.
|
A string identifier to associate with the secret.
|
||||||
@@ -219,7 +183,7 @@ A boolean specifying whether the secret must be supplied.
|
|||||||
|
|
||||||
## `env`
|
## `env`
|
||||||
|
|
||||||
A `map` of environment variables that are available to the steps of all jobs in the workflow. You can also set environment variables that are only available to the steps of a single job or to a single step. For more information, see [`jobs.<job_id>.env`](#jobsjob_idenv) and [`jobs.<job_id>.steps[*].env`](#jobsjob_idstepsenv).
|
A `map` of environment variables that are available to the steps of all jobs in the workflow. You can also set environment variables that are only available to the steps of a single job or to a single step. For more information, see [`jobs.<job_id>.env`](#jobsjob_idenv) and [`jobs.<job_id>.steps[*].env`](#jobsjob_idstepsenv).
|
||||||
|
|
||||||
Variables in the `env` map cannot be defined in terms of other variables in the map.
|
Variables in the `env` map cannot be defined in terms of other variables in the map.
|
||||||
|
|
||||||
@@ -1028,6 +992,42 @@ jobs:
|
|||||||
```
|
```
|
||||||
{% endraw %}
|
{% endraw %}
|
||||||
|
|
||||||
|
{% if actions-inherit-secrets-reusable-workflows %}
|
||||||
|
|
||||||
|
### `jobs.<job_id>.secrets.inherit`
|
||||||
|
|
||||||
|
Use the `inherit` keyword to pass all the calling workflow's secrets to the called workflow. This includes all secrets the calling workflow has access to, namely organization, repository, and environment secrets. The `inherit` keyword can be used to pass secrets across repositories within the same organization, or across organizations within the same enterprise.
|
||||||
|
|
||||||
|
#### Example
|
||||||
|
|
||||||
|
{% raw %}
|
||||||
|
|
||||||
|
```yaml
|
||||||
|
on:
|
||||||
|
workflow_dispatch:
|
||||||
|
|
||||||
|
jobs:
|
||||||
|
pass-secrets-to-workflow:
|
||||||
|
uses: ./.github/workflows/called-workflow.yml
|
||||||
|
secrets: inherit
|
||||||
|
```
|
||||||
|
|
||||||
|
```yaml
|
||||||
|
on:
|
||||||
|
workflow_call:
|
||||||
|
|
||||||
|
jobs:
|
||||||
|
pass-secret-to-action:
|
||||||
|
runs-on: ubuntu-latest
|
||||||
|
steps:
|
||||||
|
- name: Use a repo or org secret from the calling workflow.
|
||||||
|
run: echo ${{ secrets.CALLING_WORKFLOW_SECRET }}
|
||||||
|
```
|
||||||
|
|
||||||
|
{% endraw %}
|
||||||
|
|
||||||
|
{%endif%}
|
||||||
|
|
||||||
### `jobs.<job_id>.secrets.<secret_id>`
|
### `jobs.<job_id>.secrets.<secret_id>`
|
||||||
|
|
||||||
A pair consisting of a string identifier for the secret and the value of the secret. The identifier must match the name of a secret defined by [`on.workflow_call.secrets.<secret_id>`](#onworkflow_callsecretssecret_id) in the called workflow.
|
A pair consisting of a string identifier for the secret and the value of the secret. The identifier must match the name of a secret defined by [`on.workflow_call.secrets.<secret_id>`](#onworkflow_callsecretssecret_id) in the called workflow.
|
||||||
|
|||||||
Reference in New Issue
Block a user