[huang195]

Problem

Every repo calls this workflow with secrets: inherit. That passes every secret of the calling repo to this workflow, but the workflow reads only ADD_TO_PROJECT_PAT.

A caller that passes only that secret by name (secrets: ADD_TO_PROJECT_PAT: ...) fails today with Invalid secret, ADD_TO_PROJECT_PAT is not defined in the referenced workflow, because the secret is not declared here.

Change

Declare ADD_TO_PROJECT_PAT under on.workflow_call.secrets, with required: false.

• Callers that use secrets: inherit work as before. No caller has to change.
• A caller can now pass only this one secret. rossoctl/cortex is the first to do so (see security: Supply chain: provenance for all release binaries, bump go-jose to 4.1.6, pin project.yml cortex#1641).

Assisted-By: Claude (Anthropic AI) noreply@anthropic.com

[netlify]

✅ Deploy Preview for animated-crumble-fb8862 ready!

Name	Link
🔨 Latest commit	c77af8c
🔍 Latest deploy log	https://app.netlify.com/projects/animated-crumble-fb8862/deploys/6ae9fef8399ed34f56b3f383
😎 Deploy Preview	https://deploy-preview-137--animated-crumble-fb8862.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.
🤖 Make changes	Run an agent on this branch

---

To edit notification comments on pull requests, go to your Netlify project configuration.

[clawgenti]

Summary

Clean, minimal change. Declaring ADD_TO_PROJECT_PAT under on.workflow_call.secrets with required: false is the correct way to let a caller pass this one secret by name, and it stays backward compatible: callers using secrets: inherit still receive it, so no existing caller breaks. required: false fits too, because the step already runs with continue-on-error: true. A caller without the secret gets a soft failure, same as today. No must-fix issues. There is one nit, about the cross-repo reference and merge order.

Author: huang195 (MEMBER, maintainer)
Areas reviewed: CI/GitHub Actions (reusable workflow), YAML, security (secret scope, action pinning)
Agent/IDE config (.claude/.vscode): none
Commits: 1 commit, all signed-off: yes
CI status: passing (DCO, add-to-project, Netlify preview)

Verdict note: under the review rules this would be an APPROVE: no must-fix issues and the author is a maintainer. It is posted as COMMENT only because the reviewing account (clawgenti) has read-only access to rossoctl/.github (push: false), so its approval would not count toward branch protection. A maintainer with write access should approve.

[clawgenti]

nit: The PR description points to rossoctl/cortex#1641, which is the supply-chain tracking issue. The caller change itself is rossoctl/cortex#1649. Consider linking #1649 as well. Also, cortex calls this workflow at @main, so this PR has to merge before cortex#1649. Until it does, #1649 fails with Invalid secret, ADD_TO_PROJECT_PAT is not defined in the referenced workflow. A short note on merge order in either PR would help whoever merges them.

[esnible]

The change is correct and backward compatible. When a caller uses secrets: inherit, it still passes ADD_TO_PROJECT_PAT once the secret is declared under on.workflow_call.secrets. A caller can also pass the secret by name, as rossoctl/cortex#1649 does. required: false is the right choice, because the step already has continue-on-error: true.

suggestion (non-blocking): This repo's own .github/workflows/project.yml still calls the workflow with secrets: inherit, and it runs on pull_request_target. It can't get an inline comment because it isn't in the diff. You could make the same change there (secrets: ADD_TO_PROJECT_PAT: ${{ secrets.ADD_TO_PROJECT_PAT }}), in this PR or a follow-up. Then the repo that owns the workflow also follows the narrower pattern.

Author: huang195 (MEMBER — maintainer)
Areas reviewed: CI/GitHub Actions (reusable workflow), YAML, security (secret scope, action pinning)
Agent/IDE config (.claude/.vscode): none
Commits: 1 commit, all signed-off: yes
CI status: passing (DCO, add-to-project, Netlify preview)

[mrsabath]

Summary

Verified against the workflow on main and GitHub Actions semantics: an undeclared secret does make a named secrets: call fail with "Invalid secret … not defined in the referenced workflow"; declaring it with required: false keeps secrets: inherit callers unchanged; and required: false is right, since the consuming step already runs under continue-on-error: true. The action remains SHA-pinned and no secret values enter the diff — the change strictly narrows what callers must expose. 名正言順 — once properly declared, the secret can legitimately be passed by name. No must-fix issues.

Areas reviewed: CI/GitHub Actions (reusable workflow), YAML, security (secret scope, action pinning)
Commits: 1 commit, signed-off: yes (DCO passing)
CI status: passing (DCO, add-to-project, Netlify preview)

PR body: cross-reference

Not anchored inline because this is in the PR description, not a file the PR touches.

The body links rossoctl/cortex#1641, but the caller PR is actually rossoctl/cortex#1649 ("CI: Pass only ADD_TO_PROJECT_PAT to the add-to-project workflow"). Worth editing the number so the dependency is discoverable — and #1649 will fail until this merges, so merge this one first.