CI: passes only the secret each reusable workflow needs

Every reusable workflow call used 'secrets: inherit', which hands the
caller's whole secret set to the called workflow, but the only secret
any of them reads is SIGNPATH_API_TOKEN in build-windows-hosts.yml.
Passing that one secret explicitly and dropping inherit everywhere else
means a compromised step in, say, a BSD build VM has no signing token
to steal, and the workflow files now show exactly which secret flows
where.

The secret is declared optional in the reusable workflow so runs
without it (pull requests, forks) behave as before; the signing step
is already guarded to upstream push events.

.github/workflows/build-windows-hosts.yml

@@ -18,6 +18,12 @@ on:
       msys-arch:
         required: true
         type: string
+    secrets:
+      SIGNPATH_API_TOKEN:
+        description: SignPath REST API token used to submit the signing request
+        # Optional so that runs without the secret (pull requests, forks)
+        # still work; the signing step is skipped there anyway.
+        required: false
 
 env:
   CMAKE_BUILD_TYPE: ${{ vars.CMAKE_BUILD_TYPE || 'RelWithDebInfo' }}

.github/workflows/ci.yml

@@ -15,7 +15,6 @@ jobs:
       security-events: write
       contents: read
     uses: ./.github/workflows/build-no-features-test.yml
-    secrets: inherit
 
   linux-hosts:
     needs: no-features-test
@@ -34,7 +33,6 @@ jobs:
     with:
       arch: ${{ matrix.arch }}
       runs-on: ${{ matrix.runs-on }}
-    secrets: inherit
 
   linux-i686:
     needs: no-features-test
@@ -43,7 +41,6 @@ jobs:
       security-events: write
       contents: read
     uses: ./.github/workflows/build-linux-i686.yml
-    secrets: inherit
 
   linux-armv7l:
     needs: no-features-test
@@ -52,7 +49,6 @@ jobs:
       security-events: write
       contents: read
     uses: ./.github/workflows/build-linux-armv7l.yml
-    secrets: inherit
 
   linux-loong64:
     needs: no-features-test
@@ -61,7 +57,6 @@ jobs:
       security-events: write
       contents: read
     uses: ./.github/workflows/build-linux-loong64.yml
-    secrets: inherit
 
   linux-vms:
     needs: no-features-test
@@ -78,13 +73,11 @@ jobs:
     uses: ./.github/workflows/build-linux-vms.yml
     with:
       arch: ${{ matrix.arch }}
-    secrets: inherit
 
   musl-amd64:
     needs: no-features-test
     name: Musl-amd64
     uses: ./.github/workflows/build-musl-amd64.yml
-    secrets: inherit
 
   macos-hosts:
     needs: no-features-test
@@ -103,19 +96,16 @@ jobs:
     with:
       arch: ${{ matrix.arch }}
       runs-on: ${{ matrix.runs-on }}
-    secrets: inherit
 
   omnios-amd64:
     needs: no-features-test
     name: OmniOS-amd64
     uses: ./.github/workflows/build-omnios-amd64.yml
-    secrets: inherit
 
   solaris-amd64:
     needs: no-features-test
     name: Solaris-amd64
     uses: ./.github/workflows/build-solaris-amd64.yml
-    secrets: inherit
 
   freebsd-amd64:
     needs: no-features-test
@@ -124,7 +114,6 @@ jobs:
       security-events: write
       contents: read
     uses: ./.github/workflows/build-freebsd-amd64.yml
-    secrets: inherit
 
   openbsd-amd64:
     needs: no-features-test
@@ -133,7 +122,6 @@ jobs:
       security-events: write
       contents: read
     uses: ./.github/workflows/build-openbsd-amd64.yml
-    secrets: inherit
 
   netbsd-amd64:
     needs: no-features-test
@@ -142,7 +130,6 @@ jobs:
       security-events: write
       contents: read
     uses: ./.github/workflows/build-netbsd-amd64.yml
-    secrets: inherit
 
   dragonfly-amd64:
     needs: no-features-test
@@ -151,7 +138,6 @@ jobs:
       security-events: write
       contents: read
     uses: ./.github/workflows/build-dragonfly-amd64.yml
-    secrets: inherit
 
   haiku-amd64:
     if: false # Disabled because the Haiku build is currently broken
@@ -161,7 +147,6 @@ jobs:
       security-events: write
       contents: read
     uses: ./.github/workflows/build-haiku-amd64.yml
-    secrets: inherit
 
   windows-hosts:
     needs: no-features-test
@@ -189,7 +174,8 @@ jobs:
       msystem: ${{ matrix.msystem }}
       msystem-lower: ${{ matrix.msystem-lower }}
       msys-arch: ${{ matrix.msys-arch }}
-    secrets: inherit
+    secrets:
+      SIGNPATH_API_TOKEN: ${{ secrets.SIGNPATH_API_TOKEN }}
 
   release:
     if: github.event_name == 'push' && github.ref == 'refs/heads/master' && github.repository == 'fastfetch-cli/fastfetch'
@@ -215,4 +201,3 @@ jobs:
     uses: ./.github/workflows/build-release.yml
     with:
       ffversion: ${{ needs.linux-hosts.outputs.ffversion }}
-    secrets: inherit