Getting Unrecognized named-value errors in GitHub Reusable workflows.

[Shion1305]

Hi,
I was trying to create a reusable workflow for Google Cloud auth actions, but getting Unrecognized named-value and I cannot figure out what's wrong.

Here is my reusable workflow.

name: Common Google Cloud Auth

on:
  workflow_call:
    outputs:
      access_token:
        value: ${{ jobs.auth.outputs.access_token }}
jobs:
  auth:
    runs-on: ubuntu-latest
    permissions:
      contents: 'read'
      id-token: 'write'
    outputs:
      access_token: ${{ steps.auth.outputs.access_token }}
    steps:
      - name: Login to Google Cloud
        id: auth
        uses: google-github-actions/auth@v2
        with:
          token_format: access_token
          workload_identity_provider: ${{ vars.GOOGLE_WORKLOAD_IDENTITY_PROVIDER }}
          service_account: ${{ vars.GOOGLE_SERVICE_ACCOUNT }}

I've set GOOGLE_WORKLOAD_IDENTITY_PROVIDER and GOOGLE_SERVICE_ACCOUNT as repository variables so this should work, however it throws following errors.

jobs parameter is also used in the official reusable workflow example, so this should be correct. I cannot figure out this cause.
https://docs.github.com/en/actions/sharing-automations/reusing-workflows#using-outputs-from-a-reusable-workflow

[Sagargupta16]

The issue is that reusable workflows (called via workflow_call) do not have access to the calling repository's vars context.

When your reusable workflow runs, ${{ vars.GOOGLE_WORKLOAD_IDENTITY_PROVIDER }} tries to resolve against the reusable workflow's repository variables, not the caller's. If the reusable workflow lives in a different repo (or even the same repo but the variables are not found in that context), you get "Unrecognized named-value."

Fix: Pass variables as inputs

Reusable workflow (callee):

name: Common Google Cloud Auth

on:
  workflow_call:
    inputs:
      workload_identity_provider:
        required: true
        type: string
      service_account:
        required: true
        type: string
    outputs:
      access_token:
        value: ${{ jobs.auth.outputs.access_token }}

jobs:
  auth:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      id-token: write
    outputs:
      access_token: ${{ steps.auth.outputs.access_token }}
    steps:
      - name: Login to Google Cloud
        id: auth
        uses: google-github-actions/auth@v2
        with:
          token_format: access_token
          workload_identity_provider: ${{ inputs.workload_identity_provider }}
          service_account: ${{ inputs.service_account }}

Caller workflow:

jobs:
  auth:
    uses: ./.github/workflows/google-auth.yml
    with:
      workload_identity_provider: ${{ vars.GOOGLE_WORKLOAD_IDENTITY_PROVIDER }}
      service_account: ${{ vars.GOOGLE_SERVICE_ACCOUNT }}

The caller has access to its own vars context and passes them as inputs to the reusable workflow. The reusable workflow then uses inputs.* instead of vars.*.

For secrets, use the secrets parameter in workflow_call or secrets: inherit.