valkyrjaio / sindri-ts / 30742981087 / 1

100%

26.x: 100%

push

github

[Workflow] ci: Pass the Markdown check the secrets it declares (#114)

# Description

Follow-up to the Markdown check that this repository just received. The
`markdown-check` job declared `secrets: inherit`, and this repository
passes what a reusable
workflow declares, one secret at a time. `_markdown-check.yml` declares
exactly
`VALKYRJA_GHA_APP_ID` and `VALKYRJA_GHA_PRIVATE_KEY`, so the caller
names those two.

`secrets: inherit` hands the called workflow every secret the repository
holds, including secrets
it never asked for. Naming each secret keeps the grant as small as what
the workflow declares, and
it makes the caller state its own dependency instead of hiding it.

The job was written with `inherit` because the other jobs in this
`ci.yml` still use it, and
matching the file was the wrong call: the convention is the corrected
form, not the surrounding
style.

> [!NOTE]
> The other jobs in this repository's workflow files still carry
`secrets: inherit`. They predate
> this pull request and each one needs the secrets that its own reusable
workflow declares, so they
> are not changed here. Five repositories are affected and each needs
its own pass.

## Types of changes

- [X] Improvement _(non-breaking change which improves code)_
- [ ] Bug fix _(non-breaking change which fixes an issue)_
- [ ] New feature _(non-breaking change which adds functionality)_
- [ ] Deprecation _(breaking change which removes functionality)_
- [ ] Breaking change _(fix or feature that would cause existing
functionality to change)_
- [ ] Documentation improvement

## Changes

- **`.github/workflows/ci.yml`** — the `markdown-check` job now names
`VALKYRJA_GHA_APP_ID` and `VALKYRJA_GHA_PRIVATE_KEY` instead of using
`secrets: inherit`.

990 of 990 branches covered (100.0%)

Branch coverage included in aggregate %.

1601 of 1601 relevant lines covered (100.0%)

24.09 hits per line