GitHub Actions secrets: inherit does not reach a nested reusable workflow

By Daniel Zoghalchali·Latchkey

secrets: inherit forwards the caller’s secrets to a directly-called reusable workflow. It does not automatically propagate through a chain: a middle workflow must itself pass secrets: inherit (or named secrets) when it calls a deeper reusable workflow.

What this error means

Secrets are available in the first reusable workflow but empty in a reusable workflow it calls in turn.

# caller -> middle.yml (secrets: inherit) -> deploy.yml
# middle.yml calls deploy.yml WITHOUT forwarding secrets
jobs:
  go:
    uses: ./.github/workflows/deploy.yml   # secrets not forwarded -> empty in deploy.yml

Common causes

Middle workflow does not re-forward secrets

Each call boundary must explicitly forward secrets; inherit at the top does not cascade automatically.

Named secrets not re-declared

If you pass named secrets, every level must declare and pass them through.

How to fix it

Forward secrets at every nesting level

1. In the middle reusable workflow, add secrets: inherit on its call to the deeper workflow.
2. Repeat at each level of the chain.

# middle.yml
jobs:
  go:
    uses: ./.github/workflows/deploy.yml
    secrets: inherit

Pass named secrets explicitly through the chain

1. Declare the secrets under on.workflow_call.secrets in each callee.
2. Forward them by name in each uses call instead of relying on inherit.

How to prevent it

• Treat each reusable-workflow boundary as a fresh secrets scope.
• Add secrets: inherit (or named secrets) at every level of a chain.

Frequently asked questions

Related guides

References

• GitHub Actions documentation
• Workflow syntax for GitHub Actions