Reusable workflow secret missing because secrets: inherit was not passed in CI

By Daniel Zoghalchali·Latchkey

A called (reusable) workflow does not automatically receive the caller's secrets. Unless the caller passes them by name or adds secrets: inherit, every secrets.X inside the reusable workflow resolves to empty.

What this error means

Steps inside a reusable workflow fail with empty secret values, while the same secret works when used directly in the caller. The uses: call has no secrets: mapping.

jobs:
  call:
    uses: ./.github/workflows/deploy.yml
    # no secrets passed -> secrets.DEPLOY_KEY is "" inside deploy.yml

Common causes

No secrets mapping on the uses call

Reusable workflows receive only the secrets the caller explicitly forwards; omitting them leaves the callee with none.

A named secret is not declared in the callee

If passing by name, the called workflow must declare the secret under on.workflow_call.secrets to accept it.

How to fix it

Forward secrets with inherit or by name

1. Add secrets: inherit to pass all caller secrets, or map specific ones.
2. For named secrets, declare them in the callee's workflow_call.secrets.
3. Re-run so the reusable workflow receives the values.

jobs:
  call:
    uses: ./.github/workflows/deploy.yml
    secrets: inherit

Declare and map named secrets

Pass only the secrets the called workflow needs and declare them on the callee side.

# caller
secrets:
  DEPLOY_KEY: ${{ secrets.DEPLOY_KEY }}
# callee
on:
  workflow_call:
    secrets:
      DEPLOY_KEY:
        required: true

How to prevent it

• Pass secrets: inherit or map secrets explicitly to reusable workflows.
• Declare expected secrets in the called workflow.
• Prefer named passing for least privilege over blanket inherit.

Frequently asked questions

Related guides

References

• GitHub Actions documentation
• Workflow syntax for GitHub Actions