valkyrjaio / valkyrja-php / 30725319396
100%

DEFAULT BRANCH: 26.x
Ran
Jobs 1
Files 1219
Run time 2min
Badge
Embed ▾
README BADGES
x

If you need to use a raster PNG badge, change the '.svg' to '.png' in the link

Markdown

Textile

RDoc

HTML

Rst
coverage: 100.0%. Remained the same
30725319396

push

github

web-flow 
[Workflow] ci: Pass each reusable workflow the secrets it declares (#1103)

# Description

Every caller in this repository passed `secrets: inherit`. That hands
the called
workflow all eight organization secrets, whatever the workflow needs. A
PHP lint
job received the Maven signing key and the PyPI token. SonarCloud flags
the
pattern.

Each job now passes the exact list that the workflow it calls declares.

This is the consumer half of

[valkyrjaio/.github#219](https://github.com/valkyrjaio/.github/pull/219),
which
added an `on.workflow_call.secrets` block to each reusable workflow.
That change
is in v26.19.0, and this repository already pins that release, so each
name below
is one the pinned workflow declares.

## How the list was derived

For each job, the list was read from the called workflow **at the SHA
this
repository pins**, not from a copy. A name that the pinned workflow does
not
declare therefore cannot appear here. GitHub rejects such a name with
`Invalid input`, so the check is not cosmetic.

`GITHUB_TOKEN` appears in no list. GitHub gives it to a called workflow
automatically, and the `GITHUB_` prefix is reserved, so a workflow
cannot declare
it.

## A defect this fixes

`cherry-pick-commits.yml` passed **no** `secrets:` key, and
`_cherry-pick-commits.yml` mints an app token unconditionally. The job
failed at
`create-github-app-token` with an empty `app-id`. The workflow runs only
on
`workflow_dispatch`, so nothing exercised it and the failure stayed
hidden. This
pull request adds the key, so the job can mint its token.

## What the checks on this pull request prove

The checks start the callers that a pull request triggers: `ci.yml`,
`pr.yml`,
and `claude-review.yml`. A green run proves those three pass their
secrets
correctly.

The checks do **not** start `release-new-version.yml`,
`create-version-branch.yml`, `cherry-pick-commits.yml`,
`rebase-from-master.yml`,
`rebase-to-master.yml`, `restore-branch-from-backup.yml`, or
`update-depe... (continued)

12887 of 12887 relevant lines covered (100.0%)

24.38 hits per line

Jobs
ID Job ID Ran Files Coverage
1 30725319396.1 1219
100.0
 GitHub Action Run
Source Files on build 30725319396