[metalwarrior665]

I checked it briefly; this is still up for discussion. It is quite ugly but we don't have many good options.

Closes #205

Summary

This PR refactors how secrets are passed to reusable workflows, replacing the single secrets: inherit approach with three flexible methods: passing secrets by name, using ALL_SECRETS for bulk passing, or using secrets: inherit within the Apify org. This improves security by allowing explicit secret declaration and works across organization boundaries.

Key Changes

• Updated README documentation with comprehensive guidance on three secret-passing methods:

  • By name (recommended): explicit and works from any repo
  • ALL_SECRETS: bulk passing via toJSON(secrets) without maintaining a list
  • secrets: inherit: org-restricted but convenient for Apify repos

• Modified workflow files to declare accepted secrets and use fallback logic:

  • public_pr-build-test.yaml: Added secret declarations and fallback expressions using || operator
  • public_platform-tests.yaml: Added secret declarations and fallback expressions
  • public_push-build-latest.yaml: Added secret declarations and fallback expressions
  • public_platform-tests-claude-investigate-and-fix.yaml: Updated example comments to show explicit secret passing

• Enhanced run-with-apify-tokens.mjs script:

  • Added unpack() helper function to safely parse JSON secrets
  • Implemented three-tier secret lookup: APIFY_ACTOR_TOKENS → top-level secrets → ALL_SECRETS
  • Improved error messages to guide users on where to check for missing tokens

• Added masking support in checkout-restore-dependencies action:

  • New all-secrets and apify-actor-tokens inputs
  • "Mask packed secrets" step that registers individual token values as masks before they're used
  • Prevents accidental exposure of tokens extracted from JSON blobs

• Updated example workflows in README to show explicit secret passing instead of secrets: inherit

Notable Implementation Details

• Secrets passed by name take precedence over those in ALL_SECRETS, allowing callers to override
• The masking step uses jq to extract and register individual values from JSON secrets before any step can use them
• Fallback expressions use fromJSON(secrets.ALL_SECRETS || '{}') to safely handle missing secrets
• Actor tokens remain special-cased in APIFY_ACTOR_TOKENS JSON object since each repo names its own tokens
• All three methods can be mixed in a single workflow call

https://claude.ai/code/session_01Wf2reqEVbnQV3vmZ7fjekm

[JuanGalilea]

tl;dr: if its mentioned on apify-test-tools.config.json it should be passed through ALL_SECRETS (but with a different name). If not, we should state them explicitly. And these two should not mix.

I'd split these, known secrets used explicitly on the workflow or on the CLI should be explicitly stated as part of the secrets. Whereas user-defined stuff like token env vars to be read (stated on their config file) should be passed in through the secrets hack.

I see no reason for the NPM_TOKEN to be passed through ALL_SECRETS. Also, its not all secrets, but secrets taken from the test tools config the ones we want to pass in.

secrets: inherit should be a fallback for the ALL_SECRETS lookup

[metalwarrior665]

Done in ae574d6. Fixed secrets are declared and passed by name only. Config-defined secrets go in CONFIG_SECRETS (renamed from APIFY_ACTOR_TOKENS so it isn't tied to Actor tokens if the config grows). The wrapper checks CONFIG_SECRETS first, then inherited secrets. ALL_SECRETS and the fromJSON fallbacks are gone. Callers who don't want to list the names can still pass CONFIG_SECRETS: ${{ toJSON(secrets) }}; only the names the config declares get through.

---

Generated by Claude Code

[metalwarrior665]

tested on live repo, all seems good