Error passing secret to reusable workflow

user_672009 0
Viewed 1649

I'm trying to call a reusable workflow.

https://github.com/dhis2-sre/gha-workflows/blob/master/.github/workflows/instance-manager.yaml

The caller looks like the following

name: Tests, build and deploy

on:
  push:
    branches:
      - master
      - feature/**
    tags:
      - v*.*.*

  pull_request:

  workflow_dispatch:

jobs:
  call-workflow:
    uses: dhis2-sre/gha-workflows/.github/workflows/instance-manager.yaml@v0.2.0
    with:
      DOCKER_IMAGE_NAME: dhis2/instance-manager-api
      PROCESS_NAME: dhis2-instance-manager
      DOCKER_USERNAME: "${{ secrets.DOCKER_USERNAME }}"
      DOCKER_PASSWORD: "${{ secrets.DOCKER_PASSWORD }}"
      SOPS_KMS_ARN: "${{ secrets.SOPS_KMS_ARN }}"
      AWS_ACCESS_KEY_ID: "${{ secrets.AWS_ACCESS_KEY_ID }}"
      AWS_SECRET_ACCESS_KEY: "${{ secrets.AWS_SECRET_ACCESS_KEY }}"
      KUBECONFIG: "${{ secrets.KUBECONFIG }}"

I'm getting the following error

Invalid workflow file
The workflow is not valid. .github/workflows/cicd.yaml (Line: 21, Col: 24): Unrecognized named-value: 'secrets'. Located at position 1 within expression: secrets.DOCKER_USERNAME .github/workflows/cicd.yaml (Line: 22, Col: 24): Unrecognized named-value: 'secrets'. Located at position 1 within expression: secrets.DOCKER_PASSWORD

Any clue about what I'm doing wrong? Also please let me know if I should post more code

github-actions
2 Answers

The caller had secrets under "with", should be under "secrets"

Calls Workflow
...
jobs:
  call-workflow:
    uses: dhis2-sre/gha-workflows/.github/workflows/instance-manager.yaml@v0.2.0
    with:
      DOCKER_IMAGE_NAME: dhis2/instance-manager-api
      PROCESS_NAME: dhis2-instance-manager
    secrets:
      DOCKER_USERNAME: "${{ secrets.DOCKER_USERNAME }}"
      DOCKER_PASSWORD: "${{ secrets.DOCKER_PASSWORD }}"
      SOPS_KMS_ARN: "${{ secrets.SOPS_KMS_ARN }}"
      AWS_ACCESS_KEY_ID: "${{ secrets.AWS_ACCESS_KEY_ID }}"
      AWS_SECRET_ACCESS_KEY: "${{ secrets.AWS_SECRET_ACCESS_KEY }}"
      KUBECONFIG: "${{ secrets.KUBECONFIG }}"
Called Workflow
...
on:
  workflow_call:
    secrets:
      DOCKER_USERNAME:
        required: true
        description: ''
user_6720090

I was stuck on this error for a while. The problem for me was that the reusable workflow needs to declare the secrets that are passed to it. More information here.

So, for this example, you must have the following on the called workflow:

on:
  workflow_call:
    secrets:
      DOCKER_USERNAME:
        description: 'some description'
        required: true
      DOCKER_PASSWORD:
        description: 'some description'
        required: true
      SOPS_KMS_ARN:
        description: 'some description'
        required: true
      AWS_ACCESS_KEY_ID:
        description: 'some description'
        required: true
      AWS_SECRET_ACCESS_KEY:
        description: 'some description'
        required: true
      KUBECONFIG:
        description: 'some description'
        required: true

Hope it helps someone!

user_11983790
Related