ci: Only give build-steps the secrets it needs

Signed-off-by: Larry Gritz <[email protected]>
AcademySoftwareFoundation · Dec 28, 2024 · 07ff743 · 07ff743
1 parent bff3377
commit 07ff743
Show file tree

Hide file tree

Showing 2 changed files with 9 additions and 2 deletions.
diff --git a/.github/workflows/analysis.yml b/.github/workflows/analysis.yml
@@ -51,8 +51,10 @@ jobs:
     # account credentials.
     if: github.repository == 'AcademySoftwareFoundation/OpenImageIO'
     uses: ./.github/workflows/build-steps.yml
-    # Must let the called steps workflow inherit our secrets
-    secrets: inherit
+    # Must let the called steps workflow inherit necessary secrets
+    secrets:
+      GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
     with:
       nametag: ${{ matrix.nametag || 'unnamed!' }}
       runner: ${{ matrix.runner || 'ubuntu-latest' }}

diff --git a/.github/workflows/build-steps.yml b/.github/workflows/build-steps.yml
@@ -64,6 +64,11 @@ on:
         type: string
       nametag:
         type: string
+    secrets:
+        GITHUB_TOKEN:
+          required: false
+        SONAR_TOKEN:
+          required: false
 
 permissions: read-all