Skip to content

The dispatch dry run could never run — workflow_call secrets are empty on workflow_dispatch #2699

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
rbuergi merged 1 commit into from
Aug 29, 2026
Merged

The dispatch dry run could never run — workflow_call secrets are empty on workflow_dispatch #2699

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
13 changes: 9 additions & 4 deletions .github/workflows/notify-dependents.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -64,8 +64,13 @@ jobs:
# Invariant #2: assert the inputs and fail RED naming what is missing, rather than skipping.
- name: Assert the dispatch credential is configured
env:
APP_ID: ${{ secrets.app-id }}
PRIVATE_KEY: ${{ secrets.private-key }}
# 🚨 `secrets.app-id` is a workflow_call secret: on a manual workflow_dispatch there is
# no caller passing it, so it resolves to the EMPTY STRING and the assertion below
# correctly refuses. Fall back to the repo secret for the dispatch path — without this
# the dry run can never run, which would make the one tool for checking the fan-out
# untestable itself.
APP_ID: ${{ secrets.app-id || secrets.DEPENDENT_DISPATCH_APP_ID }}
PRIVATE_KEY: ${{ secrets.private-key || secrets.DEPENDENT_DISPATCH_APP_PRIVATE_KEY }}
VERSION: ${{ inputs.version }}
run: |
set -euo pipefail
Expand All @@ -85,8 +90,8 @@ jobs:
id: token
uses: actions/create-github-app-token@v2
with:
app-id: ${{ secrets.app-id }}
private-key: ${{ secrets.private-key }}
app-id: ${{ secrets.app-id || secrets.DEPENDENT_DISPATCH_APP_ID }}
private-key: ${{ secrets.private-key || secrets.DEPENDENT_DISPATCH_APP_PRIVATE_KEY }}
owner: Systemorph
# No `repositories:` — the token spans every repo the App is installed on, which IS the
# subscriber set. `contents: read` is not enough: repository_dispatch needs write.
Expand Down
Loading