秘密不會從 github 動作秘密傳遞到 github 動作中的可重用工作流

Question

我在 github 操作中創建了秘密並嘗試在可重用的工作流程中使用它們，但我無法使其工作，但是，如果我通過調用者文件硬編碼的秘密，它工作得很好

## set_env.yml
name: Sent Env Creds and Vars

on:
  push:
    branches:
      - main
      - dev
  pull_request:
    branches: [ main ]

jobs:
  deploy-dev:
    uses: ./.github/workflows/main.yml
    with:
      AWS_REGION: "us-east-2"
      PREFIX: "dev"
    secrets:
      AWS_ACCESS_KEY_ID: ${{ secrets.DEV_AWS_ACCESS_KEY_ID }}
      AWS_SECRET_ACCESS_KEY: ${{ secrets.DEV_AWS_ACCESS_KEY_ID }}

可重用工作流 = main.yml

## main.yml
name: Deploy to AWS  

# Controls when the workflow will run
on:
  workflow_call:
    inputs:
      AWS_REGION:
        required: true
        type: string
      PREFIX:
        required: true
        type: string
    secrets:
      AWS_ACCESS_KEY_ID:
        required: true
      AWS_SECRET_ACCESS_KEY:
        required: true

# A workflow run is made up of one or more jobs that can run sequentially or in parallel
jobs:
  terraform-deploy:
    runs-on: ubuntu-latest

    # Steps represent a sequence of tasks that will be executed as part of the job
    steps:
      # # Checks-out your repository under $GITHUB_WORKSPACE, so your job can access it
      - uses: actions/checkout@v2

      # Runs a set of commands using the runners shell
      - name: Run a multi-line script
        run: | 
                echo Hello, Epsilon! You are in ${{ inputs.AWS_REGION }} region ${{ inputs.PREFIX }} region 
                for dir in $(ls -l | grep '^d' | awk '{print $9}'); do
                    PARENT_DIR=`pwd`
                    echo $dir
                    cd $dir
                    terraform init -backend-config=${PARENT_DIR}/${{ inputs.PREFIX }}-backend.tfvars
                    terraform validate
                    terraform plan -var-file=${{ inputs.PREFIX }}_vars.tfvars
                    ## terraform apply -input=false -auto-approve -var-file=${{ inputs.PREFIX }}_vars.tfvars
                    cd ..
                done
        env:
          AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
          AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}

如果我在調用 main.yml 時在 set_env.yml 中對秘密進行硬編碼，如下所示，它就可以工作

  jobs:
      deploy-dev:
        uses: ./.github/workflows/main.yml
        with:
          AWS_REGION: "us-east-2"
          PREFIX: "dev"
        secrets:
          AWS_ACCESS_KEY_ID: <harcoded value>
          AWS_SECRET_ACCESS_KEY: <hardcoded value>

我一直試圖讓它在很多方面發揮作用，但沒有奏效。 請幫忙

Answer 1

截至 2022 年 5 月 3 日，現在可以使用新關鍵字inherit ： https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#onworkflow_callsecrets

在調用工作流中，您告訴它繼承可重用工作流中的秘密：

jobs:
  deploy-dev:
    uses: ./.github/workflows/main.yml
    with:
      AWS_REGION: "us-east-2"
      PREFIX: "dev"
    secrets: inherit

這使得秘密在可重用工作流程中像往常一樣可用：

with:
  myInput: ${{ secrets.MY_SECRET }}

請注意，無需在workflow_call觸發器上聲明機密。