From 757b37fb61649dffc30f7c26b2c130724cc06185 Mon Sep 17 00:00:00 2001
From: thedavidmeister <thedavidmeister@gmail.com>
Date: Thu, 14 May 2026 23:46:21 +0400
Subject: [PATCH] ci: declare workflow_call secrets on sol reusable workflows
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Adds explicit secrets blocks so callers can pass named secrets instead
of using inherit. inherit silently drops secrets when a caller in a
different org calls this reusable workflow — named passing requires the
receiver to declare the inputs. All entries are optional so existing
callers using inherit keep working.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---
 .github/workflows/rainix-sol-test.yaml | 17 ++++++++++++++++
 .github/workflows/rainix-sol.yaml      | 27 +++++++++++++++++++++++++-
 2 files changed, 43 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/rainix-sol-test.yaml b/.github/workflows/rainix-sol-test.yaml
index 21afc3e..0582869 100644
--- a/.github/workflows/rainix-sol-test.yaml
+++ b/.github/workflows/rainix-sol-test.yaml
@@ -1,6 +1,23 @@
 name: rainix-sol-test
 on:
   workflow_call:
+    secrets:
+      PRIVATE_KEY:
+        required: false
+      EXPLORER_VERIFICATION_KEY:
+        required: false
+      CI_DEPLOY_SEPOLIA_RPC_URL:
+        required: false
+      RPC_URL_ARBITRUM_FORK:
+        required: false
+      RPC_URL_BASE_FORK:
+        required: false
+      RPC_URL_BASE_SEPOLIA_FORK:
+        required: false
+      RPC_URL_FLARE_FORK:
+        required: false
+      RPC_URL_POLYGON_FORK:
+        required: false
 jobs:
   test:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/rainix-sol.yaml b/.github/workflows/rainix-sol.yaml
index b456dea..474cf6b 100644
--- a/.github/workflows/rainix-sol.yaml
+++ b/.github/workflows/rainix-sol.yaml
@@ -1,6 +1,23 @@
 name: rainix-sol
 on:
   workflow_call:
+    secrets:
+      PRIVATE_KEY:
+        required: false
+      EXPLORER_VERIFICATION_KEY:
+        required: false
+      CI_DEPLOY_SEPOLIA_RPC_URL:
+        required: false
+      RPC_URL_ARBITRUM_FORK:
+        required: false
+      RPC_URL_BASE_FORK:
+        required: false
+      RPC_URL_BASE_SEPOLIA_FORK:
+        required: false
+      RPC_URL_FLARE_FORK:
+        required: false
+      RPC_URL_POLYGON_FORK:
+        required: false
 jobs:
   static:
     uses: ./.github/workflows/rainix-sol-static.yaml
@@ -8,4 +25,12 @@ jobs:
     uses: ./.github/workflows/rainix-sol-legal.yaml
   test:
     uses: ./.github/workflows/rainix-sol-test.yaml
-    secrets: inherit
+    secrets:
+      PRIVATE_KEY: ${{ secrets.PRIVATE_KEY }}
+      EXPLORER_VERIFICATION_KEY: ${{ secrets.EXPLORER_VERIFICATION_KEY }}
+      CI_DEPLOY_SEPOLIA_RPC_URL: ${{ secrets.CI_DEPLOY_SEPOLIA_RPC_URL }}
+      RPC_URL_ARBITRUM_FORK: ${{ secrets.RPC_URL_ARBITRUM_FORK }}
+      RPC_URL_BASE_FORK: ${{ secrets.RPC_URL_BASE_FORK }}
+      RPC_URL_BASE_SEPOLIA_FORK: ${{ secrets.RPC_URL_BASE_SEPOLIA_FORK }}
+      RPC_URL_FLARE_FORK: ${{ secrets.RPC_URL_FLARE_FORK }}
+      RPC_URL_POLYGON_FORK: ${{ secrets.RPC_URL_POLYGON_FORK }}