Question

A caller workflow invokes a reusable workflow at the job level with `uses: my-org/ci/.github/workflows/deploy.yml@v2`. The reusable workflow references `${{ secrets.DEPLOY_TOKEN }}` in one of its steps. The caller passes only `with:` inputs and does not include any `secrets:` block. At runtime the deploy step fails because `DEPLOY_TOKEN` is empty, even though `DEPLOY_TOKEN` exists as a secret in the caller repository. What is the most likely cause and correct fix?

Accepted Answer

Secrets defined in the caller repository are not automatically available to a reusable workflow; the caller must either add `secrets: inherit` or explicitly map `secrets: { DEPLOY_TOKEN: ${{ secrets.DEPLOY_TOKEN }} }` in the job that calls it.

Answer

Reusable workflows cannot access any secrets at all; the token must be passed as a plaintext value via the `with:` inputs instead.

Answer

The reusable workflow must be pinned to a full commit SHA rather than `@v2` for secrets to be forwarded to it.

Answer

The secret is empty because reusable workflows require the secret to be defined at the organization level; repository-level secrets are never visible to called workflows.