I think you have to explicitly pass down the secret to your workflow. So on your workflow call you have something like this.

on:
  workflow_call:
    secrets:
      AWS_ACCESS_KEY_ID:
        required: true

and you pass it when calling it on the uses

uses: .......
    secrets:
      AWS_ACCESS_KEY_ID: ${{secrets.AWS_ACCESS_KEY_ID}}

Good luck
Dean.

This is correct.

Fwiw, it’s documented here:

  <a href="https://docs.github.com/en/actions/using-workflows/reusing-workflows#using-inputs-and-secrets-in-a-reusable-workflow" target="_blank" rel="noopener nofollow ugc">GitHub Docs</a>

Reusing workflows - GitHub Docs

Learn how to avoid duplication when creating a workflow by reusing existing workflows.

By the time we get to the call_workflow step in script_outer.yml, the “environment: dev” is already out of scope because it pertained to the outer_test step. So I would need to be able to re-declare the environment in the call_workflow step. This is not possible however. You will receive errors if you try to define an environment in the same step where you are using a uses. This means you can not pass down a secret from the environment to the inner workflow. You can only pass down secrets that are a part of the global scope and not ones that are a part of an “environment” specific scope.

It sounds like I’m having a similar or maybe the same problem. I can pass secrets down but not environment values even if they’re in the outer scope.

e.g. I have something like the following

name: CI/CD
env:

TAG_NAME: latest

on:

...
jobs:

build:

uses: <owner>/<repo>/.github/workflows/docker-build-and-push.yml@v1

with:

IMAGE_TAG: $TAG_NAME

In my docker-build-and-push.yml I have

on:
  workflow_call:
    inputs:
      IMAGE_TAG:
        required: true
        type: string

However, when it’s run, IMAGE_TAG is blank in the lower workflow.

If in the outer workflow I type in an explicit value, it works fine.

e.g.

  deploy:
    uses: <owner>/<repo>/.github/workflows/docker-build-and-push.yml@v1
    with:
      IMAGE_TAG: latest

Thanks
Dean.

Not the same issue but I have a work around for you. If you have a step before “build” that declares an output, you can use that in the call to docker-build-and-push.yml. Here’s an example:

on:
  push:
    branches-ignore:
      - qa
      - prod
jobs:

setup_vars:

runs-on: ubuntu-latest

steps:

- name: Setup shared variables

id: env_vars

run: echo "Variables set"

outputs:

TagBuild: ${{ !contains(github.ref, 'feature/') }}
tag_repo:

needs:

- setup_vars

uses: my_inner_workflow.yml@v1

with:

do_tag: ${{ needs.setup_vars.outputs.TagBuild }}

As a side note, I have had your issue before as well. I’m pretty sure it’s a bug.

I am trying to pass env variable ECR_REPOSITORY_NAME to a workflow but it doesnt work
I declare env variable in the same file

name: Create PR db on pull request
on:
 pull_request:

env:
 ECR_REPOSITORY_NAME: data-engineering/data-warehouse
 BRANCH_NAME: ${{ github.head_ref || github.ref_name }}

jobs:

 Build-Docker-image:
   name: Build docker image on GHA and upload to ECR and GHA artifact store
   uses: ./.github/workflows/build_docker_image.yml
   with:
     ECR_REPOSITORY: ${{ env.ECR_REPOSITORY_NAME }} # doesnt work
     IMAGE_TAG: ${{ github.sha }}

with:
   X: ${{ github.sha}}  # works

with:
   X: ${{ env.xyz}}  # NOT work
   X: $xyz  # NOT work