👷 Pass explicit secrets to reusable workflows

Replace secrets: inherit with the secrets each reusable workflow
actually uses, and declare them under on.workflow_call.secrets in the
called workflow. Declared as required: false so behaviour is unchanged
if a secret is missing.

Signed-off-by: David Barragán Merino <david.barragan@kaleidos.net>

.github/workflows/build-adhoc.yml

@@ -23,7 +23,12 @@ on:
 jobs:
   build-bundle:
     uses: ./.github/workflows/build-bundle.yml
-    secrets: inherit
+    secrets:
+      AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
+      AWS_REGION: ${{ secrets.AWS_REGION }}
+      AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
+      MATTERMOST_WEBHOOK: ${{ secrets.MATTERMOST_WEBHOOK }}
+      S3_BUCKET: ${{ secrets.S3_BUCKET }}
     with:
       gh_ref: ${{ inputs.gh_ref }}
       force: ${{ inputs.force }}
@@ -31,7 +36,17 @@ jobs:
   build-docker:
     needs: build-bundle
     uses: ./.github/workflows/build-docker.yml
-    secrets: inherit
+    secrets:
+      AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
+      AWS_REGION: ${{ secrets.AWS_REGION }}
+      AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
+      DOCKER_PASSWORD: ${{ secrets.DOCKER_PASSWORD }}
+      DOCKER_REGISTRY: ${{ secrets.DOCKER_REGISTRY }}
+      DOCKER_USERNAME: ${{ secrets.DOCKER_USERNAME }}
+      MATTERMOST_WEBHOOK: ${{ secrets.MATTERMOST_WEBHOOK }}
+      PUB_DOCKER_PASSWORD: ${{ secrets.PUB_DOCKER_PASSWORD }}
+      PUB_DOCKER_USERNAME: ${{ secrets.PUB_DOCKER_USERNAME }}
+      S3_BUCKET: ${{ secrets.S3_BUCKET }}
     with:
       gh_ref: ${{ inputs.gh_ref }}
       # Pin build-docker to the commit build-bundle actually bundled.
@@ -40,7 +55,8 @@ jobs:
 
   build-docker-admin-console:
     uses: ./.github/workflows/build-docker-admin-console.yml
-    secrets: inherit
+    secrets:
+      ORG_WORKFLOW_TOKEN: ${{ secrets.ORG_WORKFLOW_TOKEN }}
     with:
       gh_ref: ${{ inputs.nitrate_ref || inputs.gh_ref }}
       force: ${{ inputs.force }}

.github/workflows/build-bundle.yml

@@ -29,6 +29,17 @@ on:
       sha:
         description: 'Bundled commit, full 40-char SHA.'
         value: ${{ jobs.check.outputs.sha }}
+    secrets:
+      AWS_ACCESS_KEY_ID:
+        required: false
+      AWS_REGION:
+        required: false
+      AWS_SECRET_ACCESS_KEY:
+        required: false
+      MATTERMOST_WEBHOOK:
+        required: false
+      S3_BUCKET:
+        required: false
 
 # Literal group name: under `workflow_call`, `github.workflow` resolves to the
 # caller's workflow, which put this workflow and the other reusable one called

.github/workflows/build-develop.yml

@@ -21,7 +21,12 @@ concurrency:
 jobs:
   build-bundle:
     uses: ./.github/workflows/build-bundle.yml
-    secrets: inherit
+    secrets:
+      AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
+      AWS_REGION: ${{ secrets.AWS_REGION }}
+      AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
+      MATTERMOST_WEBHOOK: ${{ secrets.MATTERMOST_WEBHOOK }}
+      S3_BUCKET: ${{ secrets.S3_BUCKET }}
     with:
       gh_ref: "develop"
       force: ${{ inputs.force || false }}
@@ -29,7 +34,17 @@ jobs:
   build-docker:
     needs: build-bundle
     uses: ./.github/workflows/build-docker.yml
-    secrets: inherit
+    secrets:
+      AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
+      AWS_REGION: ${{ secrets.AWS_REGION }}
+      AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
+      DOCKER_PASSWORD: ${{ secrets.DOCKER_PASSWORD }}
+      DOCKER_REGISTRY: ${{ secrets.DOCKER_REGISTRY }}
+      DOCKER_USERNAME: ${{ secrets.DOCKER_USERNAME }}
+      MATTERMOST_WEBHOOK: ${{ secrets.MATTERMOST_WEBHOOK }}
+      PUB_DOCKER_PASSWORD: ${{ secrets.PUB_DOCKER_PASSWORD }}
+      PUB_DOCKER_USERNAME: ${{ secrets.PUB_DOCKER_USERNAME }}
+      S3_BUCKET: ${{ secrets.S3_BUCKET }}
     with:
       gh_ref: "develop"
       # Pin build-docker to the commit build-bundle actually bundled.
@@ -38,7 +53,8 @@ jobs:
 
   build-docker-admin-console:
     uses: ./.github/workflows/build-docker-admin-console.yml
-    secrets: inherit
+    secrets:
+      ORG_WORKFLOW_TOKEN: ${{ secrets.ORG_WORKFLOW_TOKEN }}
     with:
       gh_ref: "develop"
       force: ${{ inputs.force || false }}

.github/workflows/build-docker.yml

@@ -32,6 +32,27 @@ on:
         type: boolean
         required: false
         default: false
+    secrets:
+      AWS_ACCESS_KEY_ID:
+        required: false
+      AWS_REGION:
+        required: false
+      AWS_SECRET_ACCESS_KEY:
+        required: false
+      DOCKER_PASSWORD:
+        required: false
+      DOCKER_REGISTRY:
+        required: false
+      DOCKER_USERNAME:
+        required: false
+      MATTERMOST_WEBHOOK:
+        required: false
+      PUB_DOCKER_PASSWORD:
+        required: false
+      PUB_DOCKER_USERNAME:
+        required: false
+      S3_BUCKET:
+        required: false
 
 # Literal group name: under `workflow_call`, `github.workflow` resolves to the
 # caller's workflow, which put this workflow and the other reusable one called

.github/workflows/build-staging.yml

@@ -21,7 +21,12 @@ concurrency:
 jobs:
   build-bundle:
     uses: ./.github/workflows/build-bundle.yml
-    secrets: inherit
+    secrets:
+      AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
+      AWS_REGION: ${{ secrets.AWS_REGION }}
+      AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
+      MATTERMOST_WEBHOOK: ${{ secrets.MATTERMOST_WEBHOOK }}
+      S3_BUCKET: ${{ secrets.S3_BUCKET }}
     with:
       gh_ref: "staging"
       force: ${{ inputs.force || false }}
@@ -29,7 +34,17 @@ jobs:
   build-docker:
     needs: build-bundle
     uses: ./.github/workflows/build-docker.yml
-    secrets: inherit
+    secrets:
+      AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
+      AWS_REGION: ${{ secrets.AWS_REGION }}
+      AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
+      DOCKER_PASSWORD: ${{ secrets.DOCKER_PASSWORD }}
+      DOCKER_REGISTRY: ${{ secrets.DOCKER_REGISTRY }}
+      DOCKER_USERNAME: ${{ secrets.DOCKER_USERNAME }}
+      MATTERMOST_WEBHOOK: ${{ secrets.MATTERMOST_WEBHOOK }}
+      PUB_DOCKER_PASSWORD: ${{ secrets.PUB_DOCKER_PASSWORD }}
+      PUB_DOCKER_USERNAME: ${{ secrets.PUB_DOCKER_USERNAME }}
+      S3_BUCKET: ${{ secrets.S3_BUCKET }}
     with:
       gh_ref: "staging"
       # Pin build-docker to the commit build-bundle actually bundled.
@@ -38,7 +53,8 @@ jobs:
 
   build-docker-admin-console:
     uses: ./.github/workflows/build-docker-admin-console.yml
-    secrets: inherit
+    secrets:
+      ORG_WORKFLOW_TOKEN: ${{ secrets.ORG_WORKFLOW_TOKEN }}
     with:
       gh_ref: "staging"
       force: ${{ inputs.force || false }}

.github/workflows/build-tag.yml

@@ -24,7 +24,12 @@ concurrency:
 jobs:
   build-bundle:
     uses: ./.github/workflows/build-bundle.yml
-    secrets: inherit
+    secrets:
+      AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
+      AWS_REGION: ${{ secrets.AWS_REGION }}
+      AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
+      MATTERMOST_WEBHOOK: ${{ secrets.MATTERMOST_WEBHOOK }}
+      S3_BUCKET: ${{ secrets.S3_BUCKET }}
     with:
       gh_ref: ${{ github.ref_name }}
       force: ${{ inputs.force || false }}
@@ -32,14 +37,25 @@ jobs:
   build-docker:
     needs: build-bundle
     uses: ./.github/workflows/build-docker.yml
-    secrets: inherit
+    secrets:
+      AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
+      AWS_REGION: ${{ secrets.AWS_REGION }}
+      AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
+      DOCKER_PASSWORD: ${{ secrets.DOCKER_PASSWORD }}
+      DOCKER_REGISTRY: ${{ secrets.DOCKER_REGISTRY }}
+      DOCKER_USERNAME: ${{ secrets.DOCKER_USERNAME }}
+      MATTERMOST_WEBHOOK: ${{ secrets.MATTERMOST_WEBHOOK }}
+      PUB_DOCKER_PASSWORD: ${{ secrets.PUB_DOCKER_PASSWORD }}
+      PUB_DOCKER_USERNAME: ${{ secrets.PUB_DOCKER_USERNAME }}
+      S3_BUCKET: ${{ secrets.S3_BUCKET }}
     with:
       gh_ref: ${{ github.ref_name }}
       force: ${{ inputs.force || false }}
 
   build-docker-admin-console:
     uses: ./.github/workflows/build-docker-admin-console.yml
-    secrets: inherit
+    secrets:
+      ORG_WORKFLOW_TOKEN: ${{ secrets.ORG_WORKFLOW_TOKEN }}
     with:
       gh_ref: ${{ github.ref_name }}
       force: ${{ inputs.force || false }}
@@ -67,6 +83,13 @@ jobs:
       - build-docker
       - build-docker-admin-console
     uses: ./.github/workflows/release.yml
-    secrets: inherit
+    secrets:
+      AWS_REGION: ${{ secrets.AWS_REGION }}
+      DOCKER_PASSWORD: ${{ secrets.DOCKER_PASSWORD }}
+      DOCKER_REGISTRY: ${{ secrets.DOCKER_REGISTRY }}
+      DOCKER_USERNAME: ${{ secrets.DOCKER_USERNAME }}
+      MATTERMOST_WEBHOOK: ${{ secrets.MATTERMOST_WEBHOOK }}
+      PUB_DOCKER_PASSWORD: ${{ secrets.PUB_DOCKER_PASSWORD }}
+      PUB_DOCKER_USERNAME: ${{ secrets.PUB_DOCKER_USERNAME }}
     with:
       gh_ref: ${{ github.ref_name }}

.github/workflows/build-tmp-tokens.yml

@@ -12,13 +12,28 @@ concurrency:
 jobs:
   build-bundle:
     uses: ./.github/workflows/build-bundle.yml
-    secrets: inherit
+    secrets:
+      AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
+      AWS_REGION: ${{ secrets.AWS_REGION }}
+      AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
+      MATTERMOST_WEBHOOK: ${{ secrets.MATTERMOST_WEBHOOK }}
+      S3_BUCKET: ${{ secrets.S3_BUCKET }}
     with:
       gh_ref: "hiru-tokens-in-libs"
 
   build-docker:
     needs: build-bundle
     uses: ./.github/workflows/build-docker.yml
-    secrets: inherit
+    secrets:
+      AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
+      AWS_REGION: ${{ secrets.AWS_REGION }}
+      AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
+      DOCKER_PASSWORD: ${{ secrets.DOCKER_PASSWORD }}
+      DOCKER_REGISTRY: ${{ secrets.DOCKER_REGISTRY }}
+      DOCKER_USERNAME: ${{ secrets.DOCKER_USERNAME }}
+      MATTERMOST_WEBHOOK: ${{ secrets.MATTERMOST_WEBHOOK }}
+      PUB_DOCKER_PASSWORD: ${{ secrets.PUB_DOCKER_PASSWORD }}
+      PUB_DOCKER_USERNAME: ${{ secrets.PUB_DOCKER_USERNAME }}
+      S3_BUCKET: ${{ secrets.S3_BUCKET }}
     with:
       gh_ref: "hiru-tokens-in-libs"

.github/workflows/plugins-deploy-package.yml

@@ -27,6 +27,13 @@ on:
         description: 'Publig name (from plugins/apps/<plugin_name>-plugin)'
         type: string
         required: true
+    secrets:
+      CLOUDFLARE_ACCOUNT_ID:
+        required: false
+      CLOUDFLARE_API_TOKEN:
+        required: false
+      MATTERMOST_WEBHOOK:
+        required: false
 
 permissions:
   contents: read

.github/workflows/plugins-deploy-packages.yml

@@ -74,7 +74,10 @@ jobs:
     needs: detect-changes
     if: github.event_name == 'workflow_dispatch' || needs.detect-changes.outputs.colors_to_tokens == 'true'
     uses: ./.github/workflows/plugins-deploy-package.yml
-    secrets: inherit
+    secrets:
+      CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
+      CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
+      MATTERMOST_WEBHOOK: ${{ secrets.MATTERMOST_WEBHOOK }}
     with:
       gh_ref: "${{ inputs.gh_ref || github.ref_name }}"
       plugin_name: colors-to-tokens
@@ -83,7 +86,10 @@ jobs:
     needs: detect-changes
     if: github.event_name == 'workflow_dispatch' || needs.detect-changes.outputs.contrast == 'true'
     uses: ./.github/workflows/plugins-deploy-package.yml
-    secrets: inherit
+    secrets:
+      CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
+      CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
+      MATTERMOST_WEBHOOK: ${{ secrets.MATTERMOST_WEBHOOK }}
     with:
       gh_ref: "${{ inputs.gh_ref || github.ref_name }}"
       plugin_name: contrast
@@ -92,7 +98,10 @@ jobs:
     needs: detect-changes
     if: github.event_name == 'workflow_dispatch' || needs.detect-changes.outputs.create_palette == 'true'
     uses: ./.github/workflows/plugins-deploy-package.yml
-    secrets: inherit
+    secrets:
+      CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
+      CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
+      MATTERMOST_WEBHOOK: ${{ secrets.MATTERMOST_WEBHOOK }}
     with:
       gh_ref: "${{ inputs.gh_ref || github.ref_name }}"
       plugin_name: create-palette
@@ -101,7 +110,10 @@ jobs:
     needs: detect-changes
     if: github.event_name == 'workflow_dispatch' || needs.detect-changes.outputs.icons == 'true'
     uses: ./.github/workflows/plugins-deploy-package.yml
-    secrets: inherit
+    secrets:
+      CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
+      CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
+      MATTERMOST_WEBHOOK: ${{ secrets.MATTERMOST_WEBHOOK }}
     with:
       gh_ref: "${{ inputs.gh_ref || github.ref_name }}"
       plugin_name: icons
@@ -110,7 +122,10 @@ jobs:
     needs: detect-changes
     if: github.event_name == 'workflow_dispatch' || needs.detect-changes.outputs.lorem_ipsum == 'true'
     uses: ./.github/workflows/plugins-deploy-package.yml
-    secrets: inherit
+    secrets:
+      CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
+      CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
+      MATTERMOST_WEBHOOK: ${{ secrets.MATTERMOST_WEBHOOK }}
     with:
       gh_ref: "${{ inputs.gh_ref || github.ref_name }}"
       plugin_name: lorem-ipsum
@@ -119,7 +134,10 @@ jobs:
     needs: detect-changes
     if: github.event_name == 'workflow_dispatch' || needs.detect-changes.outputs.rename_layers == 'true'
     uses: ./.github/workflows/plugins-deploy-package.yml
-    secrets: inherit
+    secrets:
+      CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
+      CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
+      MATTERMOST_WEBHOOK: ${{ secrets.MATTERMOST_WEBHOOK }}
     with:
       gh_ref: "${{ inputs.gh_ref || github.ref_name }}"
       plugin_name: rename-layers
@@ -128,7 +146,10 @@ jobs:
     needs: detect-changes
     if: github.event_name == 'workflow_dispatch' || needs.detect-changes.outputs.table == 'true'
     uses: ./.github/workflows/plugins-deploy-package.yml
-    secrets: inherit
+    secrets:
+      CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
+      CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
+      MATTERMOST_WEBHOOK: ${{ secrets.MATTERMOST_WEBHOOK }}
     with:
       gh_ref: "${{ inputs.gh_ref || github.ref_name }}"
       plugin_name: table

.github/workflows/release.yml

@@ -13,6 +13,21 @@ on:
         description: 'Tag to release'
         type: string
         required: true
+    secrets:
+      AWS_REGION:
+        required: false
+      DOCKER_PASSWORD:
+        required: false
+      DOCKER_REGISTRY:
+        required: false
+      DOCKER_USERNAME:
+        required: false
+      MATTERMOST_WEBHOOK:
+        required: false
+      PUB_DOCKER_PASSWORD:
+        required: false
+      PUB_DOCKER_USERNAME:
+        required: false
 
 permissions:
   contents: write

.github/zizmor.yml

@@ -50,15 +50,6 @@ rules:
   github-app:
     ignore:
       - auto-label.yml
-  # Pass only the secrets each reusable workflow needs.
-  secrets-inherit:
-    ignore:
-      - build-adhoc.yml
-      - build-develop.yml
-      - build-staging.yml
-      - build-tag.yml
-      - build-tmp-tokens.yml
-      - plugins-deploy-packages.yml
   # Style nudge towards the `$/...` syntax; not worth enforcing.
   self-repository:
     disable: true