Replies: 8 comments 4 replies
-
|
If you want to use a variable in a composite action, you need to pass it as an input parameter. |
Beta Was this translation helpful? Give feedback.
-
|
Please expose |
Beta Was this translation helpful? Give feedback.
-
|
I had to do the following: ...
inputs:
vars-as-json:
description: 'Vars as JSON. Recommended to be ${{ toJSON(vars) }}'
required: true
...uses: action@v1
with:
vars-as-json: ${{ toJson(vars) }}
...It sucks since now I have this |
Beta Was this translation helpful? Give feedback.
-
|
This is particularly obnoxious since secrets are accessible. Also because shared workflows do inherit vars and secrets. Forcing the use of |
Beta Was this translation helpful? Give feedback.
-
|
Bumped into this too, I would really appreciate some detailed explanation of the rationale behind this strange current behavior or perhaps a plan to remediate it by allowing vars and secrets access from composite actions 🙏 |
Beta Was this translation helpful? Give feedback.
-
|
🕒 Discussion Activity Reminder 🕒 This Discussion has been labeled as dormant by an automated system for having no activity in the last 60 days. Please consider one the following actions: 1️⃣ Close as Out of Date: If the topic is no longer relevant, close the Discussion as 2️⃣ Provide More Information: Share additional details or context — or let the community know if you've found a solution on your own. 3️⃣ Mark a Reply as Answer: If your question has been answered by a reply, mark the most helpful reply as the solution. Note: This dormant notification will only apply to Discussions with the Thank you for helping bring this Discussion to a resolution! 💬 |
Beta Was this translation helpful? Give feedback.
-
|
The reason behind this is quite straightforward: security. People generally avoid sharing their workflows publicly. Instead, what is commonly shared are GitHub Actions. If third-party GitHub Actions had access to repository variables, it could pose significant security risks. Companies could inadvertently expose sensitive data through these variables—data that might not be sensitive within the organization but is not intended for external exposure. GitHub Actions are versioned (e.g., v4, v7), which means they are susceptible to supply chain attacks due to the lack of lock files for dependencies. Therefore, it's crucial to prevent third-party GitHub Actions from accessing repository variables by default to mitigate these risks. |
Beta Was this translation helpful? Give feedback.
Uh oh!
There was an error while loading. Please reload this page.
-
Select Topic Area
Question
Body
Hello,
I have a job calling a composite action made by myself
The composite action cannot access the
varscontext that should be provided by setting an environment in the job.Is this expected ?
The following action will make the workflow fail:
Beta Was this translation helpful? Give feedback.
All reactions