From 5a47939e66d18624a99edc2d81beec44be556fbe Mon Sep 17 00:00:00 2001 From: Alexander Tarasov Date: Wed, 5 Aug 2026 15:26:39 +0200 Subject: [PATCH] ci: Replace secrets: inherit with explicit CODECOV_TOKEN pass The test job inherited all repository secrets to call gem_test.yml, which only reads secrets.CODECOV_TOKEN but never declared it under workflow_call.secrets. Declare it explicitly and pass only that secret by name instead of exposing every repository secret to the called workflow. Refs VULN-2296 Co-Authored-By: Claude Sonnet 5 --- .github/workflows/gem_test.yml | 3 +++ .github/workflows/tests.yml | 3 ++- 2 files changed, 5 insertions(+), 1 deletion(-) diff --git a/.github/workflows/gem_test.yml b/.github/workflows/gem_test.yml index 61fadc5af..904aae65b 100644 --- a/.github/workflows/gem_test.yml +++ b/.github/workflows/gem_test.yml @@ -17,6 +17,9 @@ on: description: Space-separated apt packages to install before testing. type: string default: "" + secrets: + CODECOV_TOKEN: + required: false jobs: matrix: diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml index 7d7b63d69..4609fc5c5 100644 --- a/.github/workflows/tests.yml +++ b/.github/workflows/tests.yml @@ -40,7 +40,8 @@ jobs: with: gem: ${{ matrix.gem }} apt: ${{ matrix.apt || '' }} - secrets: inherit + secrets: + CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }} codecov: name: CodeCov