gowalk-cicd 1.0.187 → 1.0.188

package/docs/CONFIGURATION.md

@@ -76,6 +76,9 @@ are retained as sparse `workflows.<file>.overrides` entries. An override identif
 a YAML path, with `value` or `remove: true`; step paths use stable IDs/names rather
 than numeric positions. These extensions are app-owned configuration, including
 their execution conditions, dependencies and secret references.
+Reusable workflow jobs may retain GitHub's `secrets: inherit` handoff. This literal is accepted
+only at `jobs.<job>.secrets`; named secret mappings and other credential inputs still require
+GitHub secret references. Sparse overrides are checked at their rendered workflow paths.
 
 Candidate artifacts are enabled automatically for recognized execution. Custom deployment
 commands that the installer cannot establish as candidate-safe retain the normal main

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gowalk-cicd",
-  "version": "1.0.187",
+  "version": "1.0.188",
   "description": "Zero-config GitHub Actions delivery for iOS TestFlight and Android Google Play.",
   "type": "module",
   "bin": {

package/src/config/settings.mjs

@@ -59,8 +59,11 @@ export function assertReferences(value, file, path = []) {
     return;
   }
   if (typeof value !== 'string' || !value.trim()) return;
+  // GitHub's reusable-workflow handoff is syntax, not an inline credential.
+  if (value === 'inherit' && path.length === 3 && path[0] === 'jobs' && path[2] === 'secrets') return;
+  const secretValue = path[0] === 'jobs' && path[2] === 'secrets';
   const key = path.at(-1) || '';
-  if (key === 'runtime-env' && value.includes('\n')) {
+  if (key === 'runtime-env' && value.includes('\n') && !secretValue) {
     for (const line of value.split('\n').filter(line => line.trim() && !line.trim().startsWith('#'))) {
       const match = /^([A-Z_][A-Z0-9_]*)=(.*)$/.exec(line);
       if (!match) throw new MigrationRepair('unsupported_runtime_environment', file, path);
@@ -68,7 +71,7 @@ export function assertReferences(value, file, path = []) {
     }
     return;
   }
-  const credentialKey = /(?:password|private.key|ssh-key|runtime-env|token|secret|credential)/i.test(key);
+  const credentialKey = secretValue || /(?:password|private.key|ssh-key|runtime-env|token|secret|credential)/i.test(key);
   const referencesOnly = /^\s*\$\{\{[^}]+\}\}\s*$/.test(value);
   if ((credentialKey && !referencesOnly) || /-----BEGIN [A-Z ]*PRIVATE KEY-----/.test(value)
       || /https?:\/\/[^\s/@]+:[^\s/@]+@/.test(value)) {

package/src/config/workflows.mjs

@@ -108,8 +108,9 @@ export function planWorkflows(root, templateDir, files, version) {
     delete state.lock.workflows[file];
   }
   writes.push(...removed.map(file => ({ file: `.github/workflows/${file}`, content: null })));
-  assertReferences(state.config, CONFIG);
-  for (const [file, entry] of Object.entries(state.config.workflows)) {
+  const { workflows, ...settings } = state.config;
+  assertReferences(settings, CONFIG);
+  for (const [file, entry] of Object.entries(workflows)) {
     for (const change of entry.overrides) assertReferences(change.value, file, change.path);
   }
   writes.push(...planValidation(root, [...selected, WARM, RECOVERY]));