diff --git a/content/actions/using-workflows/reusing-workflows.md b/content/actions/using-workflows/reusing-workflows.md index c3a090642a..0ab6eaf05e 100644 --- a/content/actions/using-workflows/reusing-workflows.md +++ b/content/actions/using-workflows/reusing-workflows.md @@ -103,8 +103,13 @@ You can define inputs and secrets, which can be passed from the caller workflow required: true ``` {% endraw %} + {% if actions-inherit-secrets-reusable-workflows %} + For details of the syntax for defining inputs and secrets, see [`on.workflow_call.inputs`](/actions/reference/workflow-syntax-for-github-actions#onworkflow_callinputs), [`on.workflow_call.secrets`](/actions/reference/workflow-syntax-for-github-actions#onworkflow_callsecrets) and [`on.workflow_call.secrets.inherit`](/actions/using-workflows/workflow-syntax-for-github-actions#onworkflow_callsecretsinherit). + 1. In the reusable workflow, reference the input or secret that you defined in the `on` key in the previous step. If the secrets are inherited using `secrets: inherit`, you can reference them even if they are not defined in the `on` key. + {%else%} For details of the syntax for defining inputs and secrets, see [`on.workflow_call.inputs`](/actions/reference/workflow-syntax-for-github-actions#onworkflow_callinputs) and [`on.workflow_call.secrets`](/actions/reference/workflow-syntax-for-github-actions#onworkflow_callsecrets). -1. In the reusable workflow, reference the input or secret that you defined in the `on` key in the previous step. + 1. In the reusable workflow, reference the input or secret that you defined in the `on` key in the previous step. + {%endif%} {% raw %} ```yaml @@ -189,6 +194,7 @@ When you call a reusable workflow, you can only use the following keywords in th * [`jobs..with.`](/actions/reference/workflow-syntax-for-github-actions#jobsjob_idwithinput_id) * [`jobs..secrets`](/actions/reference/workflow-syntax-for-github-actions#jobsjob_idsecrets) * [`jobs..secrets.`](/actions/reference/workflow-syntax-for-github-actions#jobsjob_idsecretssecret_id) + {% if actions-inherit-secrets-reusable-workflows %}* [`jobs..secrets.inherit`](/actions/using-workflows/workflow-syntax-for-github-actions#onworkflow_callsecretsinherit){% endif %} * [`jobs..needs`](/actions/reference/workflow-syntax-for-github-actions#jobsjob_idneeds) * [`jobs..if`](/actions/reference/workflow-syntax-for-github-actions#jobsjob_idif) * [`jobs..permissions`](/actions/reference/workflow-syntax-for-github-actions#jobsjob_idpermissions) diff --git a/content/actions/using-workflows/workflow-syntax-for-github-actions.md b/content/actions/using-workflows/workflow-syntax-for-github-actions.md index c95bbcf209..57c81c47b2 100644 --- a/content/actions/using-workflows/workflow-syntax-for-github-actions.md +++ b/content/actions/using-workflows/workflow-syntax-for-github-actions.md @@ -157,6 +157,42 @@ jobs: ``` {% endraw %} +{% if actions-inherit-secrets-reusable-workflows %} + +#### `on.workflow_call.secrets.inherit` + +Use the `inherit` keyword to pass all the calling workflow's secrets to the called workflow. This includes all secrets the calling workflow has access to, namely organization, repository, and environment secrets. The `inherit` keyword can be used to pass secrets across repositories within the same organization, or across organizations within the same enterprise. + +#### Example + +{% raw %} + +```yaml +on: + workflow_dispatch: + +jobs: + pass-secrets-to-workflow: + uses: ./.github/workflows/called-workflow.yml + secrets: inherit +``` + +```yaml +on: + workflow_call: + +jobs: + pass-secret-to-action: + runs-on: ubuntu-latest + steps: + - name: Use a repo or org secret from the calling workflow. + uses: echo ${{ secrets.CALLING_WORKFLOW_SECRET }} +``` + +{% endraw %} + +{%endif%} + #### `on.workflow_call.secrets.` A string identifier to associate with the secret. diff --git a/data/features/actions-inherit-secrets-reusable-workflows.yml b/data/features/actions-inherit-secrets-reusable-workflows.yml new file mode 100644 index 0000000000..2b7e38e99c --- /dev/null +++ b/data/features/actions-inherit-secrets-reusable-workflows.yml @@ -0,0 +1,7 @@ +# Reference: #6920 +# Documentation for inheriting secrets from the calling workflow +versions: + fpt: '*' + ghec: '*' + ghes: '>= 3.6' + ghae: diff --git a/data/reusables/actions/pass-inputs-to-reusable-workflows.md b/data/reusables/actions/pass-inputs-to-reusable-workflows.md index ce6074f0c9..32d11ea33b 100644 --- a/data/reusables/actions/pass-inputs-to-reusable-workflows.md +++ b/data/reusables/actions/pass-inputs-to-reusable-workflows.md @@ -11,3 +11,19 @@ jobs: envPAT: ${{ secrets.envPAT }} ``` {% endraw %} + +{% if actions-inherit-secrets-reusable-workflows %} +Workflows that call reusable workflows in the same organization or enterprise can use the `inherit` keyword to implicitly pass the secrets. + +{% raw %} +```yaml +jobs: + call-workflow-passing-data: + uses: octo-org/example-repo/.github/workflows/reusable-workflow.yml@main + with: + username: mona + secrets: inherit +``` +{% endraw %} + +{%endif%} \ No newline at end of file