A caller workflow must give a reusable workflow access to the same repository secrets without listing each secret name. Which configuration is correct?
Select an answer to reveal the explanation.
Short Explanation and Infographic
secrets: inherit on the caller job that uses: the reusable workflow forwards the caller’s secrets. There is no permissions.secrets.write scope that dumps them, and matrix hacks are not the API.
Full explanation below image
Full Explanation
Reusable workflows may declare secrets under on.workflow_call.secrets or accept secrets: inherit from the caller. inherit passes through secrets available to the caller workflow (subject to environment and fork rules) without enumerating each key—convenient for org-standard pipelines. Explicit mapping secrets: MY_KEY: ${{ secrets.MY_KEY }} is preferred when you want least privilege and an auditable allow list. permissions blocks control GITHUB_TOKEN scopes, not repository secret export. secrets: inherit belongs on the caller’s job that references uses:, not as a substitute for defining workflow_call. Matrix cannot auto-export arbitrary secrets safely. Remember environment-scoped secrets still require the job to reference that environment.