mirror of
https://github.com/fastfetch-cli/fastfetch.git
synced 2026-10-31 18:13:38 +01:00
Thibaud-Vdb
daf5421be7
Every reusable workflow call used 'secrets: inherit', which hands the caller's whole secret set to the called workflow, but the only secret any of them reads is SIGNPATH_API_TOKEN in build-windows-hosts.yml. Passing that one secret explicitly and dropping inherit everywhere else means a compromised step in, say, a BSD build VM has no signing token to steal, and the workflow files now show exactly which secret flows where. The secret is declared optional in the reusable workflow so runs without it (pull requests, forks) behave as before; the signing step is already guarded to upstream push events.