How do you pass a specific secret to a reusable workflow without using 'secrets: inherit'?
Select an answer to reveal the explanation.
Short Explanation and Infographic
Secrets get their own 'secrets:' block in the workflow_call invocation — not mixed with 'with:' inputs.
Full explanation below image
Full Explanation
When calling a reusable workflow, secrets are passed via the 'secrets:' block (separate from 'with:' inputs): 'secrets: SECRET_NAME: ${{ secrets.SOURCE_SECRET }}'. The called workflow must have declared this secret in its 'on.workflow_call.secrets:' block. Using 'with:' for secrets would work technically but means the secret value appears in workflow logs as an expression result — using the dedicated 'secrets:' block ensures proper masking. 'secrets: MY_SECRET: value: ${{ secrets.MY_SECRET }}' has an extra 'value:' key that doesn't exist. Secrets and inputs are not interchangeable — they have different contexts.