From 2ecc0d18b2d9dd44b2ccbc91e119218acf4b028d Mon Sep 17 00:00:00 2001 From: Philip Hartlieb Date: Thu, 29 Oct 2026 12:43:21 -0400 Subject: [PATCH] Map the release key into the reusable release workflows A reusable workflow's environment job gets an environment secret only when the caller passes it, by secrets: inherit or by a same-name mapping. Declaring it under workflow_call alone leaves it empty, which stopped the first release at the credentials job. --- .github/workflows/publish.yml | 4 +++- .github/workflows/release-check.yml | 4 +++- .github/workflows/release.yml | 4 ++++ README.md | 7 +++++++ 4 files changed, 17 insertions(+), 2 deletions(-) diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml index 6b00dea..82453c0 100644 --- a/.github/workflows/publish.yml +++ b/.github/workflows/publish.yml @@ -39,7 +39,9 @@ on: description: Token for pulling private images; omit for public images required: false BLS_RELEASE_PRIVATE_KEY: - description: Never passed by a caller. Declared so the release environment's secret of this name resolves. + description: >- + Map it by name from the caller. The value comes from the release environment, which the + caller's job can't read; without the mapping the environment job sees it empty. required: false permissions: diff --git a/.github/workflows/release-check.yml b/.github/workflows/release-check.yml index 1fc8864..e630c59 100644 --- a/.github/workflows/release-check.yml +++ b/.github/workflows/release-check.yml @@ -22,7 +22,9 @@ on: default: "" secrets: BLS_RELEASE_PRIVATE_KEY: - description: Never passed by a caller. Declared so the release environment's secret of this name resolves. + description: >- + Map it by name from the caller. The value comes from the release environment, which the + caller's job can't read; without the mapping the environment job sees it empty. required: false outputs: version: diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 2fc2c3b..968e68c 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -17,6 +17,8 @@ jobs: actions: read pull-requests: read uses: $/.github/workflows/release-check.yml + secrets: + BLS_RELEASE_PRIVATE_KEY: ${{ secrets.BLS_RELEASE_PRIVATE_KEY }} tests: needs: check @@ -34,3 +36,5 @@ jobs: with: version: ${{ needs.check.outputs.version }} tag: ${{ needs.check.outputs.tag }} + secrets: + BLS_RELEASE_PRIVATE_KEY: ${{ secrets.BLS_RELEASE_PRIVATE_KEY }} diff --git a/README.md b/README.md index 49e3fdd..aefac0b 100644 --- a/README.md +++ b/README.md @@ -22,11 +22,18 @@ Pin a release by full commit SHA, with the version as a comment: jobs: check: uses: blacklanternsecurity/release-workflows/.github/workflows/release-check.yml@ # v1.0.0 + secrets: + BLS_RELEASE_PRIVATE_KEY: ${{ secrets.BLS_RELEASE_PRIVATE_KEY }} ``` Use the SHA of a `v*` tag of this repository, never a branch. Tags here are created only by the release App and can't be moved or deleted, so a version comment always matches its SHA. +`release-check.yml` and `publish.yml` read the release App key in jobs that run in the caller's `release` +environment. A reusable workflow gets an environment secret only when the caller passes it, so map it by +name as above, alongside any other secrets such as `registry-token`. The caller's own job can't read the +value; GitHub supplies it inside the environment. + ## How changes land - `dev`: pull request, required tests and security checks (CodeQL, dependency review, `actionlint`,