在GitHub可重用工作流输入中使用仓库密钥报错求助

工作流代码 #

name: Build dbt image

on:
  push:
    paths:
      - "dbt/**"
  workflow_dispatch:

jobs:
  push-image-dev:
    name: dbt dev
    uses: ./.github/workflows/my-reusable-workflow.yml
    with:
      project_id: ${{ vars.PROJECT_ID_DEV }}
      workload_identity_provider: ${{ vars.WORKLOAD_IDENTITY_PROVIDER_DEV }}
      service_account: ${{ vars.SERVICE_ACCOUNT_DEV }}
      environment: dev
      artifact_registry_repository: docker-images
      artifact_registry_domain: europe-west4-docker.pkg.dev
      image_context: dbt
      image_name: dbt-instance
      version_file_path: dbt/version.txt
      build_args: |
        DBT_ENV_SECRET_GIT_CREDENTIAL=${{ secrets.MACHINE_USER_PAT }}

错误信息 #

The workflow is not valid. .github/workflows/ci.dbt-build.yml (Line: 23, Col: 19): Unrecognized named-value: 'secrets'. Located at position 1 within expression: secrets.MACHINE_USER_PAT

解决方案 #

GitHub不允许在可重用工作流的with输入参数中直接引用secrets，需要通过job级环境变量中转实现需求：

1. 在调用可重用工作流的job中定义环境变量，将密钥赋值给该变量
2. 在build-args输入中引用这个环境变量

修改后的工作流代码：

name: Build dbt image

on:
  push:
    paths:
      - "dbt/**"
  workflow_dispatch:

jobs:
  push-image-dev:
    name: dbt dev
    # 新增：用job级环境变量存储密钥
    env:
      DBT_GIT_CREDENTIAL: ${{ secrets.MACHINE_USER_PAT }}
    uses: ./.github/workflows/my-reusable-workflow.yml
    with:
      project_id: ${{ vars.PROJECT_ID_DEV }}
      workload_identity_provider: ${{ vars.WORKLOAD_IDENTITY_PROVIDER_DEV }}
      service_account: ${{ vars.SERVICE_ACCOUNT_DEV }}
      environment: dev
      artifact_registry_repository: docker-images
      artifact_registry_domain: europe-west4-docker.pkg.dev
      image_context: dbt
      image_name: dbt-instance
      version_file_path: dbt/version.txt
      build_args: |
        # 修改为引用job级环境变量
        DBT_ENV_SECRET_GIT_CREDENTIAL=${{ env.DBT_GIT_CREDENTIAL }}

这种方式无需修改可重用工作流，就能将密钥传递到Docker构建的build-args中，同时符合GitHub的安全规则。

内容的提问来源于stack exchange，提问作者Luiscri