{ "schema": "varexis-index-free-publication-preview/1", "catalogue_version": "ice-05-tranche-61-v1", "route_id": "agentic_reviewed_github_environment_secret_selection", "record_id": "VXI-EXT-ICE05-GITHUB-ENVIRONMENT-SECRET-SELECTION-01-v1", "question": "Does passing a repository secret to a reusable workflow establish the secret value used by a job with an environment?", "answer": "GitHub documents that a called workflow’s job-level environment secret takes precedence over a same-name repository or organization secret. The caller must still pass the secret by name or inheritance; an unpassed secret can resolve to an empty value unless required. A required flag checks that the caller passes the secret, not that its value is nonempty.", "records": [ { "record_id": "VXI-EXT-ICE05-GITHUB-ENVIRONMENT-SECRET-SELECTION-01-v1", "url": "/varexis-index/records/github-environment-secret-selection.json", "content_sha256": "5efad68f7334b1bc5eed3d9a7e3921f9e61151eddb0880033347f172e277fce5", "evidence": { "schema": "varexis-public-evidence-record/0.3", "generated_at_utc": "2026-10-29T01:09:39.613311Z", "record_id": "VXI-EXT-ICE05-GITHUB-ENVIRONMENT-SECRET-SELECTION-01-v1", "record_kind": "external_reference", "title": "GitHub reusable-workflow environment secret selection", "system": "GitHub", "evidence_family": "vendor_evidence_review", "index_status": "PUBLIC_SAFE_SOURCE_REVIEW", "evidence_state": "PRIMARY_DOCUMENTATION_REVIEW_ONLY", "canonical_question": "Does passing a repository secret to a reusable workflow establish the secret value used by a job with an environment?", "near_questions": [ "Which same-name secret does a reusable workflow environment select?", "Does secrets inherit override a job environment secret?", "Can an unpassed workflow secret become an empty string?", "What evidence identifies the credential source in a called workflow?" ], "supported_claims": [ { "claim": "GitHub documents that a called workflow’s job-level environment secret takes precedence over a same-name repository or organization secret. The caller must still pass the secret by name or inheritance; an unpassed secret can resolve to an empty value unless required. A required flag checks that the caller passes the secret, not that its value is nonempty.", "reliance": "DOCUMENTED_CAPABILITY_ONLY" } ], "not_demonstrated_claims": [ "Check both secret admission and environment selection before relying on the credential source. Do not infer a live credential value or successful authentication from workflow syntax.", "Buyer implementation, live runtime enforcement, settled payment, certification or permission to act are not established.", "No expanded capabilities or licences for existing INDEX executables." ], "public_summary": "GitHub documents that a called workflow’s job-level environment secret takes precedence over a same-name repository or organization secret. The caller must still pass the secret by name or inheritance; an unpassed secret can resolve to an empty value unless required. A required flag checks that the caller passes the secret, not that its value is nonempty.", "related_record_ids": [], "source_review": { "source_type": "official_external_documentation", "source_title": "GitHub: Reuse workflows", "source_url": "https://docs.github.com/en/actions/how-tos/reuse-automations/reuse-workflows", "checked_on": "2026-10-29", "candidate_record_id": "VXI-EXT-ICE05-GITHUB-ENVIRONMENT-SECRET-SELECTION-01-v1", "candidate_record_sha256": "7ec300cd333efb2d9bfb6cf60f19428689ba74fcd879907c8e6a871aefe70ae2", "method": "Primary documentation reviewed for the published bounded statement.", "deployment_tested_by_varexis": false, "revalidation": "The delivered snapshot preserves the review date shown. Recheck current primary documentation and deployment context before relying on present applicability; payment does not trigger fresh research." }, "answer_policy": { "classification": "DOCUMENTED_WITH_DEPLOYMENT_BOUNDARY", "bounded_answer": "GitHub documents that a called workflow’s job-level environment secret takes precedence over a same-name repository or organization secret. The caller must still pass the secret by name or inheritance; an unpassed secret can resolve to an empty value unless required. A required flag checks that the caller passes the secret, not that its value is nonempty.", "required_buyer_context": "Caller secret-passing declaration; Called workflow revision; Job environment; Secret names and required flags without values. Buyer deployment not inspected.", "missing_evidence": "A broader claim needs evidence matching the intended use. Payment does not upgrade the evidence state." }, "private_boundary": "Raw logs, thresholds, private paths, source code, protected mechanisms and reconstruction-level details are excluded from public and paid delivery.", "decision_profile": { "schema": "varexis-vendor-evidence-review/1", "review_status": "documentation_review_only", "checked_on": "2026-10-29", "claim_to_check": "Does passing a repository secret to a reusable workflow establish the secret value used by a job with an environment?", "documented_statement": { "status": "documented", "statement": "GitHub documents that a called workflow’s job-level environment secret takes precedence over a same-name repository or organization secret. The caller must still pass the secret by name or inheritance; an unpassed secret can resolve to an empty value unless required. A required flag checks that the caller passes the secret, not that its value is nonempty.", "source_ids": [ "github-reuse" ] }, "review_inference": { "status": "review_inference", "statement": "Review github reusable-workflow environment secret selection before accepting the buyer claim. Nested forwarding is already reviewed; this decision concerns same-name environment selection and missing-secret behavior at the called job, which forwarding alone does not resolve. This is a documentation-review judgment, not an observed deployment outcome.", "source_ids": [ "github-reuse" ] }, "buyer_evidence_required": [ "Caller secret-passing declaration", "Called workflow revision", "Job environment", "Secret names and required flags without values" ], "review_condition": { "status": "varexis_review_policy", "statement": "Check both secret admission and environment selection before relying on the credential source. Do not infer a live credential value or successful authentication from workflow syntax." }, "unknowns": "Buyer configuration, effective authority, complete usage and final business outcomes were not inspected.", "unknown_finding": { "status": "unknown", "statement": "Buyer configuration, effective authority, complete usage and final business outcomes were not inspected." }, "evidence_sources": [ { "source_id": "github-reuse", "url": "https://docs.github.com/en/actions/how-tos/reuse-automations/reuse-workflows", "final_url": "https://docs.github.com/en/actions/how-tos/reuse-automations/reuse-workflows", "captured_at_utc": "2026-10-29T00:50:20.914447+00:00", "status": 200, "content_type": "text/html; charset=utf-8", "bytes": 471869, "sha256": "7229f465ad293a44339b80a596d4b181359a91a70495b12a5ee4a80471a59273", "title": "GitHub: Reuse workflows", "hash_basis": "SHA-256 of captured HTTP response body bytes", "checked_on": "2026-10-29", "capture_status": 200, "claim_review_completed": true, "reviewed_sections": [ "Passing inputs and secrets to a reusable workflow" ], "version_context": "Rolling official documentation captured 2026-10-29; exact response hash is pinned, not a stable vendor release. Verify the deployed API/version and account feature availability. ", "rights_review": "Original factual paraphrase and attributed source metadata only. Captured documentation and code remain private; no source prose, examples, images or vendor marks are redistributed. No licence to vendor software or buyer assurance is granted." } ], "observed_deployment": false, "commercial_reliance_boundary": "Source documentation supports only the stated boundary. Existing licensed checkers analyse supported supplied declarations; they do not query these providers, verify live systems, settle payments or certify compliance.", "paid_value": { "decision_context": "Review github reusable-workflow environment secret selection before accepting the buyer claim. Nested forwarding is already reviewed; this decision concerns same-name environment selection and missing-secret behavior at the called job, which forwarding alone does not resolve.", "free": "Complete review, practical questions, source references and limitations; freely accessible and locally saveable.", "single_request": "Unavailable for this publication-only record; historical saved retrieval remains unchanged.", "evidence_receipt": "Unavailable for this publication-only record; no new paid retrieval entitlement.", "excluded": [ "Fresh vendor research", "Live provider inspection", "Runtime enforcement or certification", "Expanded executable schemas or licences", "Native Coupa, Stripe Issuing, GitLab or Sigstore validation" ], "integrity": "Hashes identify content versions; they do not prove truth or provide a signature." }, "revalidation": { "trigger": "Recheck the source and applicable API, account and configuration before current reliance. No monitoring or fresh research is included.", "specific_watch": "Passing inputs and secrets to a reusable workflow" }, "buyer_relevance": "Review github reusable-workflow environment secret selection before accepting the buyer claim. Nested forwarding is already reviewed; this decision concerns same-name environment selection and missing-secret behavior at the called job, which forwarding alone does not resolve.", "refusal_conditions": [ "Check both secret admission and environment selection before relying on the credential source. Do not infer a live credential value or successful authentication from workflow syntax.", "Do not infer buyer deployment conformance or successful business outcomes from source documentation." ] }, "niche": { "niche_id": "ice05-governance", "label": "Agent Governance & Policy Boundaries", "classification_id": "governance", "classification_label": "Agent Governance & Policy Boundaries", "topic_id": "governance", "buyer_intent": "Review github reusable-workflow environment secret selection before accepting the buyer claim. Nested forwarding is already reviewed; this decision concerns same-name environment selection and missing-secret behavior at the called job, which forwarding alone does not resolve.", "comparison_role": "supplementary_discovery" }, "paid_access_note": "The full published answer and boundaries are free. Paid access saves the selected route and source versions, with an unsigned receipt when purchased. Preview coverage before paying. Fresh research, bespoke assessment and protected evidence are excluded.", "service_route": { "request_guide": "/varexis-index/request.html", "request_workflow": "/varexis-index/request-workflow.json", "service_id": "single_request", "service_routes_url": "/varexis-index/service-routes.json", "payment_required": true, "availability_endpoint": "/api/index/capabilities", "operational_status": "AUTOMATIC_SERVICE_CAPABILITIES_GATED", "checkout_url": "/index-access" }, "authority_boundary": "VAREXIS-INDEX informs evidence reliance. It does not provide advice, certification, deployment authority, security assurance, production approval, or guarantee.", "human_page": "/varexis-index/catalog.html#github-environment-secret-selection", "machine_readable_record": "/varexis-index/records/github-environment-secret-selection.json" } } ], "access": { "mode": "exact_http_only", "payment_required": false, "purchase_url": null, "mcp_preview_available": false, "paid_saved_retrieval_available": false, "natural_language_search_qualified": false }, "boundary": "Catalogue additions are available free through the exact HTTP JSON links below. Enhanced natural-language discovery is not yet qualified for these records. They are outside MCP search, MCP preview and paid saved retrieval. No search qualification, executable capability or entitlement is added.", "content_sha256": "ab12cdf9960cdaa0ceaba5c2330ccf6108273e7529b7f08913ede937f143d975" }