ci: replace secrets inherit with explicit secret passing

Pass only required secrets to reusable workflows instead of inheriting
all secrets. Adds secret declarations to reusable workflows.

Author: andrewrabert

.github/workflows/__automation.yml

@@ -2,6 +2,9 @@ name: Automation 🎛️
 
 on:
   workflow_call:
+    secrets:
+      JF_BOT_TOKEN:
+        required: true
 
 jobs:
   conflicts:

.github/workflows/__deploy.yml

@@ -2,6 +2,13 @@ name: Deploy 🏗️
 
 on:
   workflow_call:
+    secrets:
+      CLOUDFLARE_API_TOKEN:
+        required: true
+      CLOUDFLARE_ACCOUNT_ID:
+        required: true
+      JF_BOT_TOKEN:
+        required: true
     inputs:
       branch:
         required: true
@@ -57,7 +64,8 @@ jobs:
     # Always run so the comment is composed for the workflow summary
     if: ${{ always() }}
     uses: ./.github/workflows/__job_messages.yml
-    secrets: inherit
+    secrets:
+      JF_BOT_TOKEN: ${{ secrets.JF_BOT_TOKEN }}
     needs:
       - cf-pages
 

.github/workflows/__job_messages.yml

@@ -2,6 +2,9 @@ name: Job messages ⚙️
 
 on:
   workflow_call:
+    secrets:
+      JF_BOT_TOKEN:
+        required: true
     inputs:
       branch:
         required: false

.github/workflows/ci-deploy.yml

@@ -37,7 +37,10 @@ jobs:
     name: Deploy 🚀
     needs: get-pr-number
     uses: ./.github/workflows/__deploy.yml
-    secrets: inherit
+    secrets:
+      CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
+      CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
+      JF_BOT_TOKEN: ${{ secrets.JF_BOT_TOKEN }}
     with:
       branch: ${{ github.event.workflow_run.head_repository.full_name != github.repository && github.event.workflow_run.head_branch == 'master' && format('{0}/{1}', github.event.workflow_run.head_repository.full_name, github.event.workflow_run.head_branch) || github.event.workflow_run.head_branch }}
       commit: ${{ github.event.workflow_run.head_sha }}

.github/workflows/pull_request.yml

@@ -18,7 +18,8 @@ jobs:
     name: Automation 🎛️
     if: ${{ github.event_name == 'pull_request_target' && github.repository == 'jellyfin/jellyfin-web' }}
     uses: ./.github/workflows/__automation.yml
-    secrets: inherit
+    secrets:
+      JF_BOT_TOKEN: ${{ secrets.JF_BOT_TOKEN }}
 
   merge-queue-build:
     name: Build 🏗️
@@ -55,7 +56,10 @@ jobs:
     permissions:
       contents: read
       deployments: write
-    secrets: inherit
+    secrets:
+      CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
+      CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
+      JF_BOT_TOKEN: ${{ secrets.JF_BOT_TOKEN }}
     with:
       branch: ${{ github.head_ref }}
       commit: ${{ github.sha }}

.github/workflows/push.yml

@@ -17,7 +17,8 @@ jobs:
     name: Automation 🎛️
     if: ${{ github.repository == 'jellyfin/jellyfin-web' }}
     uses: ./.github/workflows/__automation.yml
-    secrets: inherit
+    secrets:
+      JF_BOT_TOKEN: ${{ secrets.JF_BOT_TOKEN }}
 
   main:
     name: 'Unstable release 🚀⚠️'
@@ -52,7 +53,10 @@ jobs:
     permissions:
       contents: read
       deployments: write
-    secrets: inherit
+    secrets:
+      CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
+      CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
+      JF_BOT_TOKEN: ${{ secrets.JF_BOT_TOKEN }}
     with:
       branch: ${{ github.ref_name }}
       comment: false