Skip to content

Commit 987c51c

Browse files
committed
package caller: pass AWS secrets via secrets: inherit
GitHub Actions doesn't expose the 'secrets' context in 'with:' when calling a reusable workflow. The companion PR on the shared workflow (ModernRelay/.github) moves the four AWS values into on.workflow_call.secrets; this caller drops them from 'with:' and adds 'secrets: inherit' so all four flow through masked. Trailing from PRs #33 and #34.
1 parent eeb890a commit 987c51c

1 file changed

Lines changed: 4 additions & 10 deletions

File tree

.github/workflows/package.yml

Lines changed: 4 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -9,8 +9,8 @@ name: Package
99
# AWS_ARTIFACT_BUCKET are set. Stored as secrets (not variables) so the
1010
# AWS account ID embedded in the role ARN and bucket name stays masked in
1111
# public workflow logs.
12-
# - The shared workflow at ModernRelay/.github supports the `features` and
13-
# `image_tag_suffix` inputs (ModernRelay/.github PR #2 or later).
12+
# - The shared workflow at ModernRelay/.github declares these as
13+
# on.workflow_call.secrets (see fix/omnigraph-package-use-secrets).
1414
#
1515
# Each invocation produces two ECR tags per source commit:
1616
# - <source_sha> (default features)
@@ -36,10 +36,7 @@ jobs:
3636
with:
3737
repository: ${{ github.repository }}
3838
source_ref: ${{ inputs.source_ref != '' && inputs.source_ref || github.sha }}
39-
aws_region: ${{ secrets.AWS_REGION }}
40-
aws_role_to_assume: ${{ secrets.AWS_ROLE_TO_ASSUME }}
41-
aws_codebuild_package_project: ${{ secrets.AWS_CODEBUILD_PACKAGE_PROJECT }}
42-
aws_artifact_bucket: ${{ secrets.AWS_ARTIFACT_BUCKET }}
39+
secrets: inherit
4340

4441
package_aws:
4542
name: Package aws-feature build
@@ -51,9 +48,6 @@ jobs:
5148
with:
5249
repository: ${{ github.repository }}
5350
source_ref: ${{ inputs.source_ref != '' && inputs.source_ref || github.sha }}
54-
aws_region: ${{ secrets.AWS_REGION }}
55-
aws_role_to_assume: ${{ secrets.AWS_ROLE_TO_ASSUME }}
56-
aws_codebuild_package_project: ${{ secrets.AWS_CODEBUILD_PACKAGE_PROJECT }}
57-
aws_artifact_bucket: ${{ secrets.AWS_ARTIFACT_BUCKET }}
5851
features: aws
5952
image_tag_suffix: "-aws"
53+
secrets: inherit

0 commit comments

Comments
 (0)