From e72104fd10b2158f7945265464f5279039a5b368 Mon Sep 17 00:00:00 2001
From: Jonathan Hartman
 <208858388+cx-jonathan-hartman@users.noreply.github.com>
Date: Tue, 16 Jun 2026 17:53:58 -0700
Subject: [PATCH] fix(actions): declare secrets used by reusable workflows

Adds explicit on.workflow_call.secrets declarations for all secrets
referenced in the workflow body, replacing implicit reliance on
callers using secrets: inherit.
---
 .github/workflows/run-projects.yaml | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/.github/workflows/run-projects.yaml b/.github/workflows/run-projects.yaml
index a9b747747f5..882669c0d4a 100644
--- a/.github/workflows/run-projects.yaml
+++ b/.github/workflows/run-projects.yaml
@@ -7,6 +7,15 @@ on:
         description: 'Total number of machines'
         required: true
         type: number
+    secrets:
+      CES_BUCKET_AWS_REGION:
+        required: true
+      CES_BUCKET_AWS_ROLE:
+        required: true
+      CES_EXECUTOR_REPO:
+        required: true
+      GH_TOKEN:
+        required: true
 
 env:
   ENGINE: "kics"