GitHub Actions复用Workflow无法识别Secrets的问题咨询

问题背景 #

在组织内创建了可复用的GitHub Actions Workflow，用于多个仓库的构建流程。其中包含一个post_build_custom_command输入项，允许各仓库传入自定义bash脚本作为构建后的操作。但调用时尝试在自定义命令中直接引用仓库Secrets，触发报错：

The workflow is not valid. .github/workflows/workflow.yml (Line: 23, Col: 34): Unrecognized named-value: 'secrets'. Located at position 1 within expression: secrets.PRIVATE_KEY

尝试过在可复用Workflow中定义Secrets参数，并在调用时传递，但报错仍未解决。

已尝试的无效方案 #

修改后的可复用Workflow #

name: node-ci
on:
  workflow_call:
    inputs:
      post_build_custom_command:
        description: "Custom command to run after build"
        required: false
        type: string
        default: ''
    secrets:
      PRIVATE_KEY:
        required: false

jobs:
  build:
    runs-on: ubuntu-latest
    steps:
    - name: Post Build Custom Command
      run: |
        ${{ inputs.post_build_custom_command }}
      if: ${{ inputs.post_build_custom_command }}

修改后的调用Workflow #

name: node-build-trigger
on:
  workflow_dispatch:

jobs:
  node-ci:
    uses: org/workflows/.github/workflows/node-ci.yml@main
    with:
      post_build_custom_command: |
        echo "${{ secrets.PRIVATE_KEY }}"
    secrets:
      PRIVATE_KEY: ${{ secrets.PRIVATE_KEY }}

可行替代方案 #

方案1：通过环境变量传递Secrets #

核心思路是将Secrets注入为执行自定义命令时的环境变量，自定义命令中直接使用环境变量名，避免在输入参数中嵌入表达式：

可复用Workflow修改

name: reusable-workflow
on:
  workflow_call:
    inputs:
      post_build_custom_command:
        description: "自定义构建后命令（使用环境变量如$PRIVATE_KEY引用Secrets）"
        required: false
        type: string
        default: ''
    secrets:
      PRIVATE_KEY:
        required: false

jobs:
  build:
    runs-on: ubuntu-latest
    steps:
    - name: 执行构建
      run: npm run build

    - name: 执行自定义构建后命令
      env:
        # 将传递的Secrets映射为环境变量
        PRIVATE_KEY: ${{ secrets.PRIVATE_KEY }}
      run: |
        ${{ inputs.post_build_custom_command }}
      if: ${{ inputs.post_build_custom_command }}

调用Workflow修改

name: caller-workflow
on:
  pull_request:
    branches: [main]

jobs:
  reusable-workflow:
    name: 复用构建流程
    uses: org/workflows/.github/workflows/reusable-workflow.yml@main
    with:
      post_build_custom_command: |
        echo "$PRIVATE_KEY" > /tmp/key.pem
    secrets:
      PRIVATE_KEY: ${{ secrets.PRIVATE_KEY }}

方案2：调用方单独添加Secrets处理步骤 #

如果仅少数仓库需要使用Secrets执行自定义操作，可将这部分逻辑从可复用Workflow中剥离，在调用方单独添加步骤：

可复用Workflow保持原结构

name: reusable-workflow
on:
  workflow_call:
    inputs:
      post_build_custom_command:
        description: "Custom command to run after build"
        required: false
        type: string
        default: ''

jobs:
  build:
    runs-on: ubuntu-latest
    steps:
    - name: Build
      run: npm run build

    - name: Post Build Custom Command
      run: |
        ${{ inputs.post_build_custom_command }}
      if: ${{ inputs.post_build_custom_command }}

调用Workflow修改

name: caller-workflow
on:
  pull_request:
    branches: [main]

jobs:
  build-base:
    name: 复用基础构建流程
    uses: org/workflows/.github/workflows/reusable-workflow.yml@main

  post-build-with-secrets:
    name: 含Secrets的构建后操作
    runs-on: ubuntu-latest
    needs: build-base
    steps:
    - name: 写入私钥文件
      run: |
        echo "${{ secrets.PRIVATE_KEY }}" > /tmp/key.pem

方案3：使用仓库内的脚本文件（复杂场景适用） #

如果自定义逻辑复杂且需要Secrets，可将脚本存储在各仓库中，由可复用Workflow拉取并执行：

可复用Workflow修改

name: reusable-workflow
on:
  workflow_call:
    inputs:
      post_build_script_path:
        description: "调用仓库中构建后脚本的路径"
        required: false
        type: string
        default: ''
    secrets:
      PRIVATE_KEY:
        required: false

jobs:
  build:
    runs-on: ubuntu-latest
    steps:
    - name: 拉取调用仓库代码
      uses: actions/checkout@v4
      with:
        repository: ${{ github.event.pull_request.head.repo.full_name }}
        ref: ${{ github.event.pull_request.head.ref }}
      if: ${{ inputs.post_build_script_path }}

    - name: 执行构建
      run: npm run build

    - name: 执行自定义构建后脚本
      env:
        PRIVATE_KEY: ${{ secrets.PRIVATE_KEY }}
      run: |
        chmod +x ${{ inputs.post_build_script_path }}
        ./${{ inputs.post_build_script_path }}
      if: ${{ inputs.post_build_script_path }}

调用Workflow修改

name: caller-workflow
on:
  pull_request:
    branches: [main]

jobs:
  reusable-workflow:
    name: 复用构建流程
    uses: org/workflows/.github/workflows/reusable-workflow.yml@main
    with:
      post_build_script_path: scripts/post-build.sh
    secrets:
      PRIVATE_KEY: ${{ secrets.PRIVATE_KEY }}

内容的提问来源于stack exchange，提问作者Daniel