GitHub Actions "cannot use secrets context in with" for a reusable workflow in CI

By Daniel Zoghalchali·Latchkey

Inputs passed in with: are not treated as sensitive, so GitHub forbids referencing the secrets context there. Sensitive values must go through the secrets: block, which is masked and access-controlled.

What this error means

The call fails with "you cannot use the secrets context in with" (or "Unrecognized ... secrets") on a with: value that references ${{ secrets.X }}.

Invalid workflow file: .github/workflows/ci.yml#L10
The workflow is not valid. You cannot use the secrets context
in "with" when calling a reusable workflow. Use "secrets" instead.

Common causes

A secret passed as a plain input

You put token: ${{ secrets.DEPLOY_TOKEN }} under with:. Inputs are not masked, so GitHub blocks the secrets context there.

Confusing inputs with secrets

The reusable workflow declared the value as an input rather than a secret, so the caller tried to pass a secret into it.

How to fix it

Pass secrets through the secrets block

1. Declare the value under on.workflow_call.secrets in the callee.
2. Pass it in the caller secrets: block, not with:.
3. Read it inside the reusable workflow as ${{ secrets.X }}.

# caller
jobs:
  deploy:
    uses: ./.github/workflows/deploy.yml
    secrets:
      DEPLOY_TOKEN: ${{ secrets.DEPLOY_TOKEN }}

Keep non-sensitive values as inputs

Only route sensitive values through secrets:; ordinary configuration stays in with: as inputs.

with:
  environment: production

How to prevent it

• Route every sensitive value through secrets:, never with:.
• Declare secrets under on.workflow_call.secrets in the callee.
• Keep inputs for configuration and secrets for credentials.

Frequently asked questions

Related guides

References

• GitHub Actions documentation
• Workflow syntax for GitHub Actions