From c3f838fcc590417e59b8d2edecac60ea73cf6ec8 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Juli=C3=A1n=20Gonz=C3=A1lez?= Date: Wed, 16 Sep 2026 11:03:59 -0700 Subject: [PATCH] general-pr-review: declare ANTHROPIC_API_KEY for workflow_call The workflow_call block declared no secrets, so a caller could only reach ANTHROPIC_API_KEY through secrets: inherit, which forwards every secret the calling repository can see. Declaring it lets callers pass that one secret instead. No behaviour change for existing consumers. The managed-repository ruleset runs this workflow against each repo through its own pull_request trigger rather than workflow_call, so the declaration is inert there and the secret keeps resolving from the org secret. A code search across ConductorOne and ductone finds no workflow_call references to this file today. Co-Authored-By: Claude Opus 5 (1M context) --- .github/workflows/general-pr-review.yaml | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/.github/workflows/general-pr-review.yaml b/.github/workflows/general-pr-review.yaml index c06265a..a543a84 100644 --- a/.github/workflows/general-pr-review.yaml +++ b/.github/workflows/general-pr-review.yaml @@ -1,7 +1,10 @@ on: pull_request: types: [opened, reopened, synchronize, ready_for_review] - workflow_call: {} + workflow_call: + secrets: + ANTHROPIC_API_KEY: + required: true concurrency: group: general-pr-review-${{ github.workflow_ref }}-${{ github.event.pull_request.number || github.run_id }} cancel-in-progress: true