From 0775782a0d3cae64a65a7021961660f8c96c4045 Mon Sep 17 00:00:00 2001 From: Devesh-Skyflow Date: Wed, 29 Jul 2026 16:40:12 +0530 Subject: [PATCH] SK-2986 pass PAT_ACTIONS into reusable workflow via workflow_call secret MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The checkout step in shared-build-and-deploy.yml uses `token: ${{ secrets.PAT_ACTIONS }}`, but that step runs inside a reusable (workflow_call) workflow. Reusable workflows do not inherit the caller's secrets, and PAT_ACTIONS was neither declared as a workflow_call secret nor passed by any caller — so it resolved to empty and actions/checkout failed with "Input required and not supplied: token". Declare a `pat-actions` workflow_call secret and pass it explicitly from all three callers (internal-release, release, beta-release), matching the existing secret-passing pattern. Co-Authored-By: Claude Opus 4.8 (1M context) --- .github/workflows/beta-release.yml | 3 ++- .github/workflows/internal-release.yml | 3 ++- .github/workflows/release.yml | 1 + .github/workflows/shared-build-and-deploy.yml | 7 ++++++- 4 files changed, 11 insertions(+), 3 deletions(-) diff --git a/.github/workflows/beta-release.yml b/.github/workflows/beta-release.yml index d68c1671..2870f8b5 100644 --- a/.github/workflows/beta-release.yml +++ b/.github/workflows/beta-release.yml @@ -18,4 +18,5 @@ jobs: gpg-passphrase: ${{ secrets.MAVEN_GPG_PASSPHRASE }} skyflow-credentials: ${{ secrets.SKYFLOW_CREDENTIALS }} >> .env test-expired-token: ${{ secrets.TEST_EXPIRED_TOKEN }} >> .env - test-reusable-token: ${{ secrets.TEST_REUSABLE_TOKEN }} >> .env \ No newline at end of file + test-reusable-token: ${{ secrets.TEST_REUSABLE_TOKEN }} >> .env + pat-actions: ${{ secrets.PAT_ACTIONS }} \ No newline at end of file diff --git a/.github/workflows/internal-release.yml b/.github/workflows/internal-release.yml index ce1145b3..ac14e1b8 100644 --- a/.github/workflows/internal-release.yml +++ b/.github/workflows/internal-release.yml @@ -24,4 +24,5 @@ jobs: gpg-passphrase: ${{ secrets.JFROG_GPG_PASSPHRASE }} skyflow-credentials: ${{ secrets.SKYFLOW_CREDENTIALS }} >> .env test-expired-token: ${{ secrets.TEST_EXPIRED_TOKEN }} >> .env - test-reusable-token: ${{ secrets.TEST_REUSABLE_TOKEN }} >> .env \ No newline at end of file + test-reusable-token: ${{ secrets.TEST_REUSABLE_TOKEN }} >> .env + pat-actions: ${{ secrets.PAT_ACTIONS }} \ No newline at end of file diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 9d7b3873..f808875c 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -18,3 +18,4 @@ jobs: skyflow-credentials: ${{ secrets.SKYFLOW_CREDENTIALS }} >> .env test-expired-token: ${{ secrets.TEST_EXPIRED_TOKEN }} >> .env test-reusable-token: ${{ secrets.TEST_REUSABLE_TOKEN }} >> .env + pat-actions: ${{ secrets.PAT_ACTIONS }} diff --git a/.github/workflows/shared-build-and-deploy.yml b/.github/workflows/shared-build-and-deploy.yml index 900c2aef..e0193a9e 100644 --- a/.github/workflows/shared-build-and-deploy.yml +++ b/.github/workflows/shared-build-and-deploy.yml @@ -50,6 +50,9 @@ on: test-reusable-token: required: true + pat-actions: + required: true + jobs: publish: runs-on: ubuntu-latest @@ -61,7 +64,9 @@ jobs: # checkout and reused for the automated version-bump push below, so # that push satisfies the branch-protection ruleset's repo-admin # bypass (github-actions[bot] is not a bypass actor). See SK-2986. - token: ${{ secrets.PAT_ACTIONS }} + # Passed through workflow_call.secrets since reusable workflows do + # not inherit the caller's secrets automatically. + token: ${{ secrets.pat-actions }} - name: Set up maven or jfrog repository uses: actions/setup-java@v1