From 8298424ae0ed46fc8c977daafaeeea9ac94cec22 Mon Sep 17 00:00:00 2001 From: Thibaud-Vdb Date: Wed, 5 Aug 2026 11:05:42 +0200 Subject: [PATCH] ci: pass only the secret the release workflow needs Both reusable calls to release.yml used 'secrets: inherit', which forwards the caller's entire secret set. The only secret release.yml reads is BLOB_READ_WRITE_TOKEN, used by the build-font job to upload the code points blob; npm publishing is OIDC trusted publishing and needs no token secret at all. Declare that one secret on the reusable workflow and pass it explicitly, so the workflow files show exactly which secret flows into the release path and nothing else does. It is declared optional, so tag-push runs (which read it from the repo secrets directly) and forks without the secret behave as before. --- .github/workflows/ci.yml | 6 ++++-- .github/workflows/release.yml | 4 ++++ 2 files changed, 8 insertions(+), 2 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index c1657562d..8722afd6a 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -110,14 +110,16 @@ jobs: if: github.repository == 'lucide-icons/lucide' needs: create-release uses: './.github/workflows/release.yml' - secrets: inherit + secrets: + BLOB_READ_WRITE_TOKEN: ${{ secrets.BLOB_READ_WRITE_TOKEN }} with: version: ${{ needs.create-release.outputs.VERSION }} dispatch-release: if: github.event_name == 'workflow_dispatch' uses: './.github/workflows/release.yml' - secrets: inherit + secrets: + BLOB_READ_WRITE_TOKEN: ${{ secrets.BLOB_READ_WRITE_TOKEN }} with: version: ${{ inputs.version }} tag: ${{ inputs.tag }} diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index ad4b92321..4ec303539 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -15,6 +15,10 @@ on: description: NPM tag default: 'latest' type: string + secrets: + BLOB_READ_WRITE_TOKEN: + description: Token used by build-font to upload the code points blob + required: false permissions: id-token: write # Required for OIDC