Question

A team has a reusable workflow defined with `on: workflow_call` that requires a secret named `DEPLOY_TOKEN` and an input named `environment`. A caller workflow triggered by `workflow_dispatch` must invoke this reusable workflow, forwarding a repository secret `PROD_DEPLOY_TOKEN` and a manually entered environment value. Which caller-side job configuration correctly passes both the input and the secret?

Accepted Answer

Use `uses: ./.github/workflows/deploy.yml`, then provide `with:
  environment: ${{ inputs.environment }}` and `secrets:
  DEPLOY_TOKEN: ${{ secrets.PROD_DEPLOY_TOKEN }}` at the job level.

Answer

Use `uses: ./.github/workflows/deploy.yml`, then place both `environment` and `DEPLOY_TOKEN` under a single `with:` block, referencing `${{ secrets.PROD_DEPLOY_TOKEN }}` for the token.

Answer

Add a step inside the caller job that runs `gh workflow run deploy.yml` and passes the secret via an environment variable named `DEPLOY_TOKEN`.

Answer

Use `uses: ./.github/workflows/deploy.yml` with `secrets: inherit` and pass `environment` under `env:` at the job level.