A reusable workflow declares its accepted inputs and secrets under workflow_call, and a caller invokes it with the uses key. The caller must pass a required string input named image_tag and a secret named REGISTRY_TOKEN. Which combination of keys does the caller use to supply these values to the reusable workflow?
jobs:
deploy:
uses: octo-org/repo/.github/workflows/deploy.yml@v2
<keys>- APass both image_tag and REGISTRY_TOKEN under a single with map, because inputs and secrets are both delivered to a reusable workflow through the with key.
- BPass image_tag under an inputs map and REGISTRY_TOKEN under an env map, because the caller mirrors the input and environment blocks of the reusable workflow.
- CPass image_tag under a with map and REGISTRY_TOKEN under a secrets map at the calling job, matching the input and secret names declared under workflow_call. Correct
- DPass image_tag under a with map and REGISTRY_TOKEN under a needs map, because needs forwards the calling workflow's secrets into the reusable workflow.
Why A is wrong: Tempting because with does carry inputs, but secrets are not passed through with. A reusable workflow receives secrets through a separate secrets map, and routing a secret through with would not satisfy its secrets declaration.
Why B is wrong: Tempting because the reusable workflow defines an inputs block, but the caller supplies values through with, not a map literally named inputs, and a secret is passed through secrets rather than through env.
Why C is correct: A caller supplies declared inputs through the with map and declared secrets through the secrets map on the calling job, so each key name matches the workflow_call definitions and the values reach the reusable workflow.
Why D is wrong: Tempting because both keys appear on jobs, but needs only declares job dependencies and ordering. It does not forward secrets, so the secret would never reach the reusable workflow.