Can not use secrets in composite jobs

Describe the bug A clear and concise description of what the bug is. I have tried using the following documentation to pass a secret from a workflow to the composite job: documentation I am trying to call a composite job specified in action.yaml (existing in 1 repo), and the caller (a workflow file in a separate repo).

To Reproduce Steps to reproduce the behavior: See my gist here: link to gist Put the 2 files in separate repos. Try to pass a variable from the workflow files repo to the composite job.

Expected behavior That it would not fail with an error and display the value of the passed secret. ( I understand that it could be masked in output log)

Runner Version and Platform

Version of your runner? I am using the github-hosted runner, so I assume it is the most current version.

OS of the machine running the runner? OSX/Windows/Linux/… Linux

What’s not working?

Please include error messages and screenshots. This ends up giving me the following error: Error: /home/runner/work/my-repo/my-repo/./.github/actions/my-action/action.yml: Error: /home/runner/work/my-repo/my-repo/./.github/actions/my-action/action.yml: (Line: 12, Col: 54, Idx: 253) - (Line: 12, Col: 54, Idx: 253): Mapping values are not allowed in this context. Error: System.ArgumentException: Unexpected type '' encountered while reading 'action manifest root'. The type 'MappingToken' was expected. at GitHub.DistributedTask.ObjectTemplating.Tokens.TemplateTokenExtensions.AssertMapping(TemplateToken value, String objectDescription) at GitHub.Runner.Worker.ActionManifestManager.Load(IExecutionContext executionContext, String manifestFile) Error: Fail to load /home/runner/work/my-repo/my-repo/./.github/actions/my-action/action.yml

[minaf1]

interesting, I found the issue with my setup. I had this for the echo command in my composite job: run: echo "use secret: ${{ inputs.secret }}" I believe the colon in the command was being interpreted as a mapping, giving me the error. Thank you for the help guys, this feature is going to help immensely.

[fearphage]

Perhaps the issue is because the 2 files are in different repositories

It has nothing to do with the number of repos. Here I am using @thboop’s action from my repo.

https://github.com/fearphage/simple-actions-demo