consuming-environment-secrets-in-reusable-workflows/

[giscus[bot]]

consuming-environment-secrets-in-reusable-workflows/

One canonical use of reusable workflows is a reusable deployment job. While this is definitely possible with reusable workflows, it’s not easy to get it working. In this post I’ll show you how to do it.

https://colinsalmcorner.com/consuming-environment-secrets-in-reusable-workflows/

[FidelusAleksander]

https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idsecretsinherit
Inherit secrets instead

[VladimirSlavik]

That did not work for me, though, it gives empty values, same as the second attempt. There might be some combination to make it work, but it isn't straightforward to guess.

[VladimirSlavik]

Let me correct that. Yes, it works. The caveat is that the caller workflow must do secrets: inherit while the reusable workflow must set environment: something on its job. Then, one can leave out the rest described here and just do ${{secrets.whatever}} in the steps.

Applying the mental models of variable scopes and function calls from imperative languages to this is very misleading. That's actually reversed here - the callee defines what's passed (environment) and the caller instead names the parameters (secrets).

Also, if you are not interested in sharing the reusable workflow, just use a constant instead of input for the environment. You already know what environments you have in your repo/org...

[rednevals]

There is one more gotcha'... Environment specific secrets are not passed whether inheriting or explicitly declaring secrets. I have 7 repository secrets and three that are different per environment. The three environment secrets are empty in the reusable action.

[VladimirSlavik]

Once I understood where which bit goes, I could just use environment secrets - with workflows in the same repository. So perhaps the "does not work" needs to be more specific?

[rednevals]

I was able to get things working after opening a support ticket with GitHub. The secrets: inherit does work. My problem was that I did not reference the passed value for the environment correctly. I was using "github.event.inputs." instead of "inputs." to reference them. It was a simple fix caused by cut-n-paste error ;)

[nkreiger]

Am I right in assuming this only works if you are doing it all within a singular repository. If you try to set up an "enterprise" standard workflow that other workflows call, you can't access the secrets if its in another repository?

Example:
Repo A -> Repo B

Repo C -> Repo B

Repo D -> Repo B

Where Repo B is the shared re-usable workflow. And I want it to have its own secrets.

[colindembovsky]

Correct - only secrets from the calling repo (A/C/D in this case) are accessible. You'll need to use org-level secrets if you want the same secrets across multiple repos, even if they're calling the same reusable workflow repo (repo B).

[Louis-Tian]

The method in Attemp#1 is the way and only obviously way that it should "works".

Both the reusable workflow and environment serves the same target use case of deploying to different target (i.e. staging and production) as examplified by it examples used on its own official documentation. Yet they don't work coherently.

The very existence of this blog post is a manifest of Github's failure in product design.

[colindembovsky]

I don't particularly like this design decision - however, it does make it very explicit what repos/workflows are consuming secrets, so the product team argues this is a more secure design.

[petrdanecek]

is the same technique applicable to Environment vars / reusable inputs?
I need to define variable in the environment which is consumed in called/reusable workflow the same way as secret.
It works for global vars, but not able to make it functional for Environment var..secrets works fine.
something like

caller

jobs:
deploy_dev:
name: Deploy to Dev
uses: colindembovsky/reusable-workflows-env-secrets/.github/workflows/reusable-deploy.yml@main
with:
environment: dev
dev_defined_var: ${{ vars.DEV_DEFINED_VAR }}

called

on:
workflow_call:
inputs:
dev_defined_var:
required: true
type: string

[ticteam]

Hi Colin,
thank you for this nice article.
But I would like to get the secrets from github in my reusable workflow and not handover it like:
secrets:
PASSWORD: ${{ secrets.PASSWORD }}
in that case I would need to duplicate my step to get the secrets for each env to each workflow that is calling my reusable....

I only would like to handover the STAGE and get the secrets at the reusable like:

• name: getting STAGE AWS secrets
  env:
  STAGE: ${{ inputs.STAGE }}
  run: |
  echo "GETTING CREDENTIALS FOR $STAGE"
  if [[ $STAGE == 'dev' ]] ; then
  echo "AWS_TEAM_ACCOUNT_ID=xxxxxxxxxxxxxxxx" >> $GITHUB_ENV
  echo "AWS_ACCESS_KEY_ID=${{ secrets.AWS_ACCESS_KEY_ID_DEV }}" >> "$GITHUB_ENV"
  echo "AWS_SECRET_ACCESS_KEY=${{ secrets.AWS_SECRET_ACCESS_KEY_DEV }}" >> "$GITHUB_ENV"