Skip to content
Latchkey

How to Inherit Secrets in a Reusable Workflow in GitHub Actions

secrets: inherit passes all of the caller's secrets to the reusable workflow without listing each one.

Instead of mapping secrets name by name, set secrets: inherit on the calling job. The reusable workflow then reads any of the caller's secrets directly.

Steps

  • In the reusable workflow, reference secrets.<name> as usual.
  • In the caller job, add secrets: inherit (a scalar, not a map).
  • Confirm the caller and called workflows are in the same trust boundary.

Caller workflow

.github/workflows/ci.yml
jobs:
  deploy:
    uses: my-org/ci/.github/workflows/deploy.yml@main
    secrets: inherit

Gotchas

  • inherit only works when the reusable workflow lives in the same org or is called within your trust boundary.
  • It forwards every secret, so prefer explicit mapping when you want least privilege.

Related guides

Run this faster and cheaper on Latchkey managed runners. Start free →