Which two approaches correctly provide secrets to a called reusable workflow? (Choose two.)
Select all correct answers, then click Submit.
Short Explanation and Infographic
Pass secrets via secrets: inherit or explicit secrets mapping declared on workflow_call. Environment files and committed .env patterns are not the supported interface.
Full explanation below image
Full Explanation
Reusable workflows define optional secrets under on.workflow_call.secrets. Callers either pass secrets: inherit (passes available secrets through) or map named secrets explicitly. GITHUB_ENV does not cross the workflow-call boundary as a secrets channel. Committing encrypted env files undermines GitHub's secret storage and audit model. Prefer explicit mapping when the called workflow should receive only a subset. Remember environment secrets still require the job to reference that environment.