004.md

deny_inherit_secrets

secrets: inherit should not be used

Examples

❌

jobs:
  release:
    uses: suzuki-shunsuke/go-release-workflow/.github/workflows/release.yaml@v0.4.4
    secrets: inherit # `inherit` should not be used

⭕

jobs:
  release:
    uses: suzuki-shunsuke/go-release-workflow/.github/workflows/release.yaml@v0.4.4
    secrets: # Only required secrets should be passed
      gh_app_id: ${{ secrets.APP_ID }}
      gh_app_private_key: ${{ secrets.APP_PRIVATE_KEY }}

Why?

Secrets should be exposed to only required jobs.

How to ignore the violation

We don't recommend, but if you want to ignore the violation of this policy, please configure it with the configuration file.

e.g.

ghalint.yaml

excludes:
  - policy_name: deny_inherit_secrets
    workflow_file_path: .github/workflows/actionlint.yaml
    job_name: actionlint

policy_name, workflow_file_path, and job_name are required.