apunkt/omnigraph
1
0
Fork 0
mirror of https://github.com/ModernRelay/omnigraph.git synced 2026-06-09 01:35:18 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions

package caller: pass AWS secrets via secrets: inherit

Browse source 
GitHub Actions doesn't expose the 'secrets' context in 'with:' when
calling a reusable workflow. The companion PR on the shared workflow
(ModernRelay/.github) moves the four AWS values into
on.workflow_call.secrets; this caller drops them from 'with:' and adds
'secrets: inherit' so all four flow through masked.

Trailing from PRs #33 and #34.
This commit is contained in:
andrew 2026-04-18 21:54:08 +03:00
parent eeb890a4f5
commit 987c51c376
1 changed files with 4 additions and 10 deletions
Download patch file Download diff file Expand all files Collapse all files

14
.github/workflows/package.yml vendored
View file

@ -9,8 +9,8 @@ name: Package
# AWS_ARTIFACT_BUCKET are set. Stored as secrets (not variables) so the
# AWS account ID embedded in the role ARN and bucket name stays masked in
# public workflow logs.
# - The shared workflow at ModernRelay/.github supports the `features` and
# `image_tag_suffix` inputs (ModernRelay/.github PR #2 or later).
# - The shared workflow at ModernRelay/.github declares these as
# on.workflow_call.secrets (see fix/omnigraph-package-use-secrets).
#
# Each invocation produces two ECR tags per source commit:
# - <source_sha> (default features)
@ -36,10 +36,7 @@ jobs:
with:
repository: ${{ github.repository }}
source_ref: ${{ inputs.source_ref != '' && inputs.source_ref || github.sha }}
aws_region: ${{ secrets.AWS_REGION }}
aws_role_to_assume: ${{ secrets.AWS_ROLE_TO_ASSUME }}
aws_codebuild_package_project: ${{ secrets.AWS_CODEBUILD_PACKAGE_PROJECT }}
aws_artifact_bucket: ${{ secrets.AWS_ARTIFACT_BUCKET }}
secrets: inherit
package_aws:
name: Package aws-feature build
@ -51,9 +48,6 @@ jobs:
with:
repository: ${{ github.repository }}
source_ref: ${{ inputs.source_ref != '' && inputs.source_ref || github.sha }}
aws_region: ${{ secrets.AWS_REGION }}
aws_role_to_assume: ${{ secrets.AWS_ROLE_TO_ASSUME }}
aws_codebuild_package_project: ${{ secrets.AWS_CODEBUILD_PACKAGE_PROJECT }}
aws_artifact_bucket: ${{ secrets.AWS_ARTIFACT_BUCKET }}
features: aws
image_tag_suffix: "-aws"
secrets: inherit