Reusable workflows unable to leverage GHA environments?

[pantelis-karamolegkos]

Select Topic Area

Question

Body

I have the following job

  build-and-push-docker-image:
    name: Build and push docker image
    if: github.repository == 'Org/repo'
    uses: Org/repo/.github/workflows/reusable.yaml@main
    with:
      dockerfile: My_Dockerfile
    environment:
      name: Production
    needs:
      - job-1
      - job-2
    secrets:
      SECRET_1: ${{ secrets.SECRET_1 }}

This fails the basic syntax checking as follows:

The workflow is not valid. .github/workflows/my_workflow.yml (Line: 236, Col: 5): Unexpected value 'environment'

Why is that?

[pantelis-karamolegkos]

Is there any chance reusable workflows are not compatible with Environments?

[gponto]

We have the same issue; it doesn't seem possible to use environments with reusable workflows. This impedes our ability to adopt reusable workflows.

[louis-bompart]

Hey @pantelis-karamolegkos, jobs that call a reusable workflow support only a subset of keyword jobs.<job_name>.* keywords, you can find them here:
https://docs.github.com/en/actions/using-workflows/reusing-workflows#supported-keywords-for-jobs-that-call-a-reusable-workflow

[mg-maia]

You can parametrise the environment and put it directly in the reusable workflow.
Not passing an environment input will skip the environment keyword inside the reusable job.

# reusable-workflow.yml
on:
  workflow_call:
    inputs:
      environment:
        required: false
        type: string
        default: ''
jobs:
  my-job:
    name: Run something
    environment: ${{ inputs.environment }}
    timeout-minutes: 60
    runs-on: ubuntu-22.04
    steps:

# caller-workflow.yml
jobs:
  my-job:
    uses: ./.github/workflows/reusable-workflow.yml
    with:
      environment: your-environment-name

[jpadif]

This works if the reusable-workflow is in the same repository as the caller workflow.

But if they're in a separate repository you won't be able to access the variables set within the environment.

Let's say that in CallerRepo you created an environment named production, and that environment has a variable named REPO_VARIABLE.

# org/repoA/.github/workflows/reusable-workflow.yml
on:
  workflow_call:
    inputs:
      environment:
        required: false
        type: string
        default: ''
jobs:
  my-job:
    name: Run something
    environment: ${{ inputs.environment }} 
    timeout-minutes: 60
    runs-on: ubuntu-22.04
    steps:
      - name: get_var
         run: |
             echo "${{ vars.REPO_VARIABLE }}"

If you call the reusable workflow like this, REPO_VARIABLE in reusable-workflow.yml will be empty

# callerRepo/,github/workflows/caller-workflow.yml
... 

jobs:
  my-job:
    uses: org/repoA/.github/workflows/reusable-workflow.yml
    with:
      environment: production
 ...

---

So right now the only way of using environments with reusable workflows is by extracting the variables that you need and passing them to the reusable workflow.

# callerRepo/,github/workflows/caller-workflow.yml
... 

jobs:
  prepare_env:
    runs-on: ubuntu-latest
    environment: production
    outputs:
      repo_variable: ${{ steps.get_path.outputs.repo_variable }}
    steps:
      - name: Get vars
        id: get_var
        run: |
          echo "repo_variable=${{ vars.REPO_VARIABLE }}" >> $GITHUB_OUTPUT
  my-job:
    uses: org/repoA/.github/workflows/reusable-workflow.yml
    needs: prepare_env
    with:
      environment: production
      REPO_VARIABLE: ${{ needs.prepare_env.outputs.repo_variable }}
 ...



# Then change reusable-workflow.yml to get the variable from inputs rather than from var

on:
  workflow_call:
    inputs:
      environment:
        required: false
        type: string
        default: ''
      REPO_VARIABLE
        required: true
        type: string
jobs:
  my-job:
    name: Run something
    environment: ${{ inputs.environment }} 
    timeout-minutes: 60
    runs-on: ubuntu-22.04
    steps:
      - name: get_var
         run: |
             echo "${{ inputs.REPO_VARIABLE }}"

In this case something like secrets: inherit but for variables would be ideal.

[rauerhans]

this is not true, you can use vars and secrets and in the called reusable workflow defined in another repo and it will refer to the GHA vars and secrets of the repo of the calling workflow

[github-actions[bot]]

🕒 Discussion Activity Reminder 🕒

This Discussion has been labeled as dormant by an automated system for having no activity in the last 60 days. Please consider one the following actions:

1️⃣ Close as Out of Date: If the topic is no longer relevant, close the Discussion as out of date at the bottom of the page.

2️⃣ Provide More Information: Share additional details or context — or let the community know if you've found a solution on your own.

3️⃣ Mark a Reply as Answer: If your question has been answered by a reply, mark the most helpful reply as the solution.

Note: This dormant notification will only apply to Discussions with the Question label. To learn more, see our recent announcement.

Thank you for helping bring this Discussion to a resolution! 💬

[rauerhans]

It's extremely annoying that this is still the only way to do it. It makes no sense to me. You could easily allow environment in the job of a calling workflow. And then pass GHA vars/secrets as inputs/named secrets to the called workflow.