Github Actions reusable workflow doesn't recognize secrets

[dbeilin]

Select Topic Area

Question

Body

I'm running Github Actions within my organization's repos. I created a reusable workflow that I apply to multiple repos.

Here is a snippet from the reusable workflow:

name: reusable-workflow
on:
  workflow_call:
    inputs:
      post_build_custom_command:
        description: "Custom command to run after build"
        required: false
        type: string
        default: ''

jobs:
  build:
    runs-on: ubuntu-latest
    steps:
    - name: Build
      run: npm run build

    - name: Post Build Custom Command
      run: |
        ${{ inputs.post_build_custom_command }}
      if: ${{ inputs.post_build_custom_command }}

I want to specifically focus on the Post Build Custom Command task. I created it specially for a certain repo, which had a lot of similar parts as the reusable workflow, but I had to create this "custom command" input to run a bash script which is custom to that repo.

In my caller repo, I call the reusable workflow as so:

name: caller-workflow

on:
  pull_request:
    branches: [main]

jobs:
  reusable-workflow:
    name: reusable-workflow
    uses: org/workflows/.github/workflows/reusable-workflow.yml@main
    with:
      post_build_custom_command: |
        echo "${{ secrets.PRIVATE_KEY }}" > /tmp/key.pem
    secrets: inherit

With the above structure, I'm getting the following error when the actions are triggered:

The workflow is not valid. .github/workflows/workflow.yml (Line: 23, Col: 34): Unrecognized named-value: 'secrets'. Located at position 1 within expression: secrets.PRIVATE_KEY

I assume it's not possible to use a repo's secrets when I'm using a reusable workflow.

What are my alternatives if I want to keep using the reusable workflow in this repo?

[shekharh500]

is it resolved? @dbeilin

[jmauerhan]

I'm having the same problem, not resolved.

[jmauerhan]

Actually I found this doc: https://docs.github.com/en/enterprise-cloud@latest/actions/using-workflows/reusing-workflows#passing-inputs-and-secrets-to-a-reusable-workflow

To pass named inputs to a called workflow, use the with keyword in a job. Use the secrets keyword to pass named secrets. For inputs, the data type of the input value must match the type specified in the called workflow (either boolean, number, or string).

Workflows that call reusable workflows in the same organization or enterprise can use the inherit keyword to implicitly pass the secrets.

Using inherit worked for me.

[tragiclifestories]

inherit doesn't always work. Imagine you have a reusable workflow for building docker images. You want to allow callers to add build args.

on:
  workflow_call:
    inputs:
      build-args:
        type: string
        default: ''
   steps:
     # ... etc ... 
     - uses: "docker/build-push-action@v5"
       with:
         build-args:
           SOMETHING=${{ secrets.SOME_SHARED_TOKEN }}
           ${{ inputs.build-args }}

Then you might want to add a build-time secret in from the a calling repo. This secret could be a repo-specific thing so you don't want to inherit it or add it to the build env for every usage of the shared workflow. Ideally you'd want to do this, but you can't:

 image-build:
   uses: "path/to/my/workflow.yml@master"
   with:
     build-args: |
       FOO=${{ secrets.foo }}
       BAR=${{ secrets.bar }}

You can't seem to access any context within with: for a reusable workflow, which is extremely limiting.

[github-actions[bot]]

🕒 Discussion Activity Reminder 🕒

This Discussion has been labeled as dormant by an automated system for having no activity in the last 60 days. Please consider one the following actions:

1️⃣ Close as Out of Date: If the topic is no longer relevant, close the Discussion as out of date at the bottom of the page.

2️⃣ Provide More Information: Share additional details or context — or let the community know if you've found a solution on your own.

3️⃣ Mark a Reply as Answer: If your question has been answered by a reply, mark the most helpful reply as the solution.

Note: This dormant notification will only apply to Discussions with the Question label. To learn more, see our recent announcement.

Thank you for helping bring this Discussion to a resolution! 💬

[natanaelfiorilla-scopely]

Is this going to be addressed somehow?

[indiarasabarreto]

When you don't want to use the inherit keyword, you need to set each secret in the reusable workflow workflow_call trigger configuration, and share each secret from the main workflow (calling the reusable) as secrets inputs.

[BourgoisMickael]

It used to work well for same repo reusable workflow without having to specify any secret anywhere in the reusable workflow, it would have access without problem, but now we need to put secrets: inherit for the workflow to have access. 😡

[oleksandrk-dev]

I found solution for this problem.

secrets are not recognised in the with, but they work in secrets

So, this will throw an error

    with:
      client: "client-go"
      token:  ${{ secrets.TOKEN }}

but this will work

    with:
      client: "client-go"
    secrets:
      token:  ${{ secrets.TOKEN }}

[Goondrious]

Worked for me, but also needed to declare all the secrets passed in the CALLED workflow (described here)

[shatakshiiii]

this worked for me, Thanks!

[abhi-iac]

The way it worked for me is, I have defined variables in caller workflow under workflow_call and then in the calling workflow defined as

secrets:
     key-id: $ {{ secrets.key-id }}

[github-actions[bot]]

🕒 Discussion Activity Reminder 🕒

This Discussion has been labeled as dormant by an automated system for having no activity in the last 60 days. Please consider one the following actions:

1️⃣ Close as Out of Date: If the topic is no longer relevant, close the Discussion as out of date at the bottom of the page.

2️⃣ Provide More Information: Share additional details or context — or let the community know if you've found a solution on your own.

3️⃣ Mark a Reply as Answer: If your question has been answered by a reply, mark the most helpful reply as the solution.

Note: This dormant notification will only apply to Discussions with the Question label. To learn more, see our recent announcement.

Thank you for helping bring this Discussion to a resolution! 💬

[RapGeneral]

Is there any solution to this problem?
I also have a reusable workflow that uses secrets with inherit, but also need the secrets passed in another argument.

[cig-max]

I have similar problem: Invalid workflow file The workflow is not valid. .github/workflows Unrecognized named-value: 'secrets' Located at position within expression secrets.
Can anyone from GitHub answer?

[jeroenzeegers]

Any news guys?

[abhivarma007]

I am in the same boat.

I am passing a secrets in the custom action so it can access from the enterprise level secrets.

job:
  steps:
   -name: get token
    run: "echo {{ secrets.ent-meta-token }}"

Then I will call from my current workflow. But still throwing the error, anyone able to find the workaround?

Unrecognized named-value: 'secrets'. Located at position 1 within expression:
at GitHub.DistributedTask.ObjectTemplating.TemplateValidationErrors.Check()
at GitHub.Runner.Worker.ActionManifestManager.ConvertRuns(IExecutionContext executionContext, TemplateContext templateContext, TemplateToken inputsToken, String fileRelativePath, MappingToken outputs)
at GitHub.Runner.Worker.ActionManifestManager.Load(IExecutionContext executionContext, String manifestFile)

[github-actions[bot]]

🕒 Discussion Activity Reminder 🕒

This Discussion has been labeled as dormant by an automated system for having no activity in the last 60 days. Please consider one the following actions:

1️⃣ Close as Out of Date: If the topic is no longer relevant, close the Discussion as out of date at the bottom of the page.

2️⃣ Provide More Information: Share additional details or context — or let the community know if you've found a solution on your own.

3️⃣ Mark a Reply as Answer: If your question has been answered by a reply, mark the most helpful reply as the solution.

Note: This dormant notification will only apply to Discussions with the Question label. To learn more, see our recent announcement.

Thank you for helping bring this Discussion to a resolution! 💬

[digglife]

What's the purpose of this restriction? There must be some reason, right?

[GalOzRlz]

Very restrictive. I want to run a pre build script with a secret and this blocks me.

[tmkdensity]

@tragiclifestories 's example is so accurate... it really needs to be adressed.