actions / actions/runner

Configuration variables are empty when passed as secrets to reusable workflow

Open
#2,414 13 comments 14 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

bug
Dominant language
C#
Stars
6.3k
Forks
1.4k
Avg merge
1d 16h
Merged PRs (30d)
24

Description

Describe the bug
Configuration variables (introduced recently by Github) are empty when passed as secrets to a reusable workflow.

To Reproduce
Steps to reproduce the behavior:

  1. Setup a Repository or Organization based configuration variable in settings:
MY_VAR=some-value
  1. Create a test reusable workflow with some secret as a parameter, like:
on:
  workflow_call:
    secrets:
      my-secret:
        required: false
jobs:
  my-job:
    name: My Job
    runs-on: ubuntu-latest
    steps:
      - name: Test Vars
        run: |
          echo '${{ secrets.my-secret }}'  | sed 's/./& /g'
                  
  1. Create a main workflow with a job that reusing workflow from previous step
  2. Pass the configuration variable as a secret, like:
on:
  workflow_dispatch:
  
jobs:
  build:
    name: Step1
    uses: <my-org>/github-actions/.github/workflows/test-workflow.yaml@main
    secrets:
      my-secret: ${{ vars.MY_VAR }}

Expected behavior
output of MY_VAR (with spaces between letters to unmask the value)

Runner Version and Platform

2.301.1

Ubuntu

What's not working?

If you modify the test, add inputs to reusable workflow and pass the var to the input at the same time with passing that to secrets, THAT WORKS! That is the reason, why it was qualified as a bug and not a feature.

Here is a workaround:

# Reusable workflow
on:
  workflow_call:
    secrets:
      my-secret:
        required: false
    inputs:
      my-input:
        required: false
        type: string
        default: ''
jobs:
  my-job:
    name: My Job
    runs-on: ubuntu-latest
    steps:
      - name: Test Vars
        run: |
          echo '${{ secrets.my-secret }}'  | sed 's/./& /g'

# Main workflow

on:
  workflow_dispatch:
  
jobs:
  build:
    name: Step1
    uses: <my-org>/github-actions/.github/workflows/test-workflow.yaml@main
    secrets:
      my-secret: ${{ vars.MY_VAR }}
    with:
      my-input:  ${{ vars.MY_VAR }}

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by reproducing the issue with the reusable-workflow and calling-workflow YAML shown in the report on runner version 2.301.1 and Ubuntu. Compare passing ${{ vars.MY_VAR }} through secrets with the documented with input workaround. Done means configuration variables are preserved when passed as secrets without requiring an additional input.

Written by the indexing model from the issue text.

Assessment

Tech stack
github-actions
Domain
ci-cd
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.