Mixed `${{ inputs }}` reusable workflow and caller workflow

Describe the bug The inputs between workflow_call and workflow_dispatch are unified (https://github.blog/changelog/2022-06-10-github-actions-inputs-unified-across-manual-and-reusable-workflows/). However, I found a corner case that seems to behave incorrectly. When a workflow runs on workflow_dispatch event and calls a reusable workflow, the reusable workflow’s inputs contain not only its defined inputs, but also the calling workflow’s inputs (from the dispatch event)

To Reproduce

1. Create workflow.yml:

on:
  workflow_dispatch:
    inputs:
      release-tag:
        description: "Release tag to test"
        required: false
        default: v1
        type: string
  
jobs:
  release:
    permissions:
    uses: <repo>/<name>/.github/workflows/reusable.yml@main
    with:
      name1: value1

1. create reusable workflow:

on:
  workflow_call:
    inputs:
      name1:
        description: "name 1"
        required: true
        type: string

jobs:
  test:
    outputs:
    runs-on: ubuntu-latest
    steps:
      - run: |
         echo "inputs: ${{ inputs }}"

This will show both the name1 and release-tag, even though the input to the reusable workflow has only one input defined (name1).

Expected behavior Only the name1 input should show.

Runner Version and Platform

Version of your runner?

ubuntu-latest

What’s not working?

Please include error messages and screenshots.

Job Log Output

If applicable, include the relevant part of the job / step log output here. All sensitive information should already be masked out, but please double-check before pasting here.

Runner and Worker’s Diagnostic Logs

If applicable, add relevant diagnostic log information. Logs are located in the runner’s _diag folder. The runner logs are prefixed with Runner_ and the worker logs are prefixed with Worker_. Each job run correlates to a worker log. All sensitive information should already be masked out, but please double-check before pasting here.

[ChristopherHX]

Non authoritative workaround, as implemented in my GitHub Actions Emulator in my fork of this runner.

How can we reliably distinguish them?

Remove all inputs not defined in the same workflow file.

• pass ${{ tojson(inputs) }} to a step
• make the oidc call
• Use oidc.job_workflow_ref and oidc.job_workflow_sha (sha is important otherwise the file could have changed) to download the current reusable workflow
• remove all inputs not defined in the on.workflow_call.inputs mapping as key

Why does this work?

when A calls B and B calls C, that is, A - B - C

• A has only workflow_dispatch inputs
• B has all workflow_call directly passed to it + defaults for not passed inputs, all inputs not declared in the on.workflow_call.inputs section are filled up by workflow_dispatch inputs
• C has all workflow_call directly passed to it + defaults for not passed inputs, all inputs not declared in the on.workflow_call.inputs section are filled up by workflow_dispatch inputs (No inputs of Workflow B are present)

That was actually our intention to include both calling workflow’s input and reusable workflow’s input

I think you actually mean “That was actually our intention to include both workflow_dispatch’s input and reusable workflow’s input”. Calling workflow’s input would imply inputs of workflow B leak into workflow C, this is not the case.

[Makperson]

Hi,

Are there any updates on that? I’ve checked and it looks like it’s still working like that. Which is kind of funny, because this way, when I run the reusable workflow “By itself” it’s gonna fail due to no input.