Remote secrets are never fetched when the only trigger is `workflow_call`

Open Beginner friendly
#386 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty
2/5
Estimated time
1-3 hours
Newbie friendliness
82/100
Issue type
Bug
Clarity
Clearly specified
Activity status
Quiet
Tech stack
typescript
Domain
devtools

Research direction

Start in languageserver/src/context-providers/secrets.ts around lines 32-39, where the early return occurs before getRemoteSecrets. Reproduce completion for a workflow_call-only workflow via Neovim or direct stdio JSON-RPC, then verify remote secrets are offered while explicitly passed secrets and GITHUB_TOKEN remain correct.

Written by the indexing model from the issue text.

Description

bug

Describe the bug

In a workflow_call-only workflow, the secrets context never fetches remote secrets, so completion offers only GITHUB_TOKEN and explicitly passed in secrets. vars fetches normally in the same file.

When a caller uses secrets: inherit, secrets available to the caller are reachable and should be offered for completion.

To Reproduce

  1. In an org-owned repo, open:

    name: probe
on:
  workflow_call:
jobs:
  build:
    runs-on: ubuntu-latest
    steps:
      - run: echo
        env:
          A: ${{ secrets. }}
          B: ${{ vars. }}

  2. Complete after secrets.: offers only GITHUB_TOKEN. Complete after vars.: offers all org and repo variables.

  3. Add push: alongside workflow_call: and the org and repo secrets appear.

When secrets are passed in explicitly, the completion is correct (GITHUB_TOKEN plus the secrets passed in), but without explicit secrets, a caller might use secrets: inherit.

Expected behavior

With secrets explicitly passed in, the current behaviour is fine. Without, remote secrets should be fetched and offered.

Package/Area

  • Expressions
  • Workflow Parser
  • Language Service
  • Language Server

Package Version

@actions/languageserver v0.3.60, also present in v0.3.61.

Additional context

languageserver/src/context-providers/secrets.ts returns before getRemoteSecrets:

https://github.com/actions/languageservices/blob/4043eda158e16579cc5fb1b0b07a4bce2a76f0b5/languageserver/src/context-providers/secrets.ts#L32-L39

Reproduced via Neovim gh_actions_ls and direct stdio JSON-RPC.

Dominant language
TypeScript
Stars
193
Forks
74
No merged PRs in 30d

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from actions/languageservices

All issues in actions/languageservices

Similar issues

More TypeScript issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.