ci: Only give build-steps the secrets it needs

Signed-off-by: Larry Gritz <lg@larrygritz.com>
AcademySoftwareFoundation · Dec 28, 2024 · 70da097 · 70da097
1 parent bff3377
commit 70da097
Show file tree

Hide file tree

Showing 2 changed files with 7 additions and 2 deletions.
diff --git a/.github/workflows/analysis.yml b/.github/workflows/analysis.yml
@@ -51,8 +51,10 @@ jobs:
     # account credentials.
     if: github.repository == 'AcademySoftwareFoundation/OpenImageIO'
     uses: ./.github/workflows/build-steps.yml
-    # Must let the called steps workflow inherit our secrets
-    secrets: inherit
+    # Must let the called steps workflow inherit necessary secrets
+    secrets:
+      - GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      - SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
     with:
       nametag: ${{ matrix.nametag || 'unnamed!' }}
       runner: ${{ matrix.runner || 'ubuntu-latest' }}

diff --git a/.github/workflows/build-steps.yml b/.github/workflows/build-steps.yml
@@ -64,6 +64,9 @@ on:
         type: string
       nametag:
         type: string
+    secrets:
+        - GITHUB_TOKEN
+        - SONAR_TOKEN
 
 permissions: read-all