From abf80f17fb8c689ecb6f728ffd245e590e6a8bf7 Mon Sep 17 00:00:00 2001 From: Prashanth Rajaram Date: Mon, 24 Oct 2022 18:03:51 -0700 Subject: [PATCH] chore(docs): Update composite action secret access Add access note about secrets for composite actions Fixes #12705 --- content/actions/learn-github-actions/contexts.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/actions/learn-github-actions/contexts.md b/content/actions/learn-github-actions/contexts.md index 2629ad6dba..bdf5bb0bfb 100644 --- a/content/actions/learn-github-actions/contexts.md +++ b/content/actions/learn-github-actions/contexts.md @@ -608,7 +608,7 @@ jobs: ## `secrets` context -The `secrets` context contains the names and values of secrets that are available to a workflow run. The `secrets` context is not available for composite actions. For more information about secrets, see "[Encrypted secrets](/actions/security-guides/encrypted-secrets)." +The `secrets` context contains the names and values of secrets that are available to a workflow run. The `secrets` context is not available for composite actions due to security reasons. If you want to pass a secret to a composite action, you need to do it explicitly as an input. For more information about secrets, see "[Encrypted secrets](/actions/security-guides/encrypted-secrets)." `GITHUB_TOKEN` is a secret that is automatically created for every workflow run, and is always included in the `secrets` context. For more information, see "[Automatic token authentication](/actions/security-guides/automatic-token-authentication)."