SEC007 — secrets-inherit

Severity: warning · Category: Security

What it checks

Flags a job that calls a reusable workflow (uses: ./.github/workflows/...) with secrets: inherit instead of forwarding specific secrets.

Why it matters

secrets: inherit forwards every secret the calling workflow has access to — organization, repository, and environment secrets alike — into the reusable workflow, whether it needs them or not. That makes it impossible to audit which secrets a given reusable workflow actually runs with just by reading its own file, and it violates least privilege: a compromise of the reusable workflow now has access to secrets it never needed in the first place.

Examples

Flagged:

jobs:
  publish:
    uses: ./.github/workflows/publish.yml
    secrets: inherit

Fixed — only the secrets the reusable workflow actually declares as inputs are forwarded:

jobs:
  publish:
    uses: ./.github/workflows/publish.yml
    secrets:
      registry-token: ${{ secrets.REGISTRY_TOKEN }}

Suppressing

The finding is reported on the secrets: inherit line itself, which is exactly where the comment goes:

    secrets: inherit # vlotpipe: ignore[SEC007]

A legitimate case for this: a release-orchestration workflow that fans out to many downstream reusable workflows, each needing a different subset of a large secret set, where writing out every explicit mapping is real ongoing maintenance burden for marginal benefit. Real-world projects vetted while building vlotpipe made exactly this trade-off deliberately, with the reasoning documented inline.