Function extractCallWorkflowSecrets

pkg/workflow/call_workflow_secrets.go:22–40

extractCallWorkflowSecrets returns the list of secret names declared in the worker workflow's on.workflow_call.secrets section. This is used by orchestrator workflows to map secrets explicitly instead of using secrets: inherit. Priority: .lock.yml > .yml (same as extractCallWorkflowPermissions). .m

(workflowName, markdownPath string)

// Returns nil when no compiled workflow file is found or when no secrets are declared,
// which signals the caller to fall back to secrets: inherit for backward compatibility.
func extractCallWorkflowSecrets(workflowName, markdownPath string) ([]string, error) {
	fileResult, err := findWorkflowFile(workflowName, markdownPath)
	if err != nil {
		return nil, fmt.Errorf("failed to find workflow file for '%s': %w", workflowName, err)
	}

	// Priority: .lock.yml > .yml
	if fileResult.lockExists {
		return extractSecretsFromWorkflowFile(fileResult.lockPath)
	}

	if fileResult.ymlExists {
		return extractSecretsFromWorkflowFile(fileResult.ymlPath)
	}

	// No compiled file found — return nil so the caller falls back to secrets: inherit.
	callWorkflowSecretsLog.Printf("No compiled workflow file found for '%s', falling back to secrets: inherit", workflowName)
	return nil, nil
}

// extractSecretsFromWorkflowFile parses a .lock.yml or .yml workflow file and returns
// the secret names declared in its on.workflow_call.secrets section.