How to Inherit Secrets in a Reusable Workflow in GitHub Actions
secrets: inherit passes all of the caller's secrets to the reusable workflow without listing each one.
Instead of mapping secrets name by name, set secrets: inherit on the calling job. The reusable workflow then reads any of the caller's secrets directly.
Steps
- In the reusable workflow, reference
secrets.<name>as usual. - In the caller job, add
secrets: inherit(a scalar, not a map). - Confirm the caller and called workflows are in the same trust boundary.
Caller workflow
.github/workflows/ci.yml
jobs:
deploy:
uses: my-org/ci/.github/workflows/deploy.yml@main
secrets: inheritGotchas
inheritonly works when the reusable workflow lives in the same org or is called within your trust boundary.- It forwards every secret, so prefer explicit mapping when you want least privilege.
Related guides
How to Pass Secrets to a Reusable Workflow in GitHub ActionsForward named secrets into a reusable GitHub Actions workflow by declaring workflow_call.secrets and mapping…
How to Call a Reusable Workflow From Another Repository in GitHub ActionsReference a reusable GitHub Actions workflow that lives in a different repository with the owner/repo path sy…