ci: Only give build-steps the secrets it needs

Signed-off-by: Larry Gritz <[email protected]>
AcademySoftwareFoundation · Dec 28, 2024 · 181cf13 · 181cf13
1 parent bff3377
commit 181cf13
Showing 1 changed file with 4 additions and 2 deletions.
diff --git a/.github/workflows/analysis.yml b/.github/workflows/analysis.yml
@@ -51,8 +51,10 @@ jobs:
     # account credentials.
     if: github.repository == 'AcademySoftwareFoundation/OpenImageIO'
     uses: ./.github/workflows/build-steps.yml
-    # Must let the called steps workflow inherit our secrets
-    secrets: inherit
+    # Must let the called steps workflow inherit necessary secrets
+    secrets:
+      - GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      - SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
     with:
       nametag: ${{ matrix.nametag || 'unnamed!' }}
       runner: ${{ matrix.runner || 'ubuntu-latest' }}