From e0fb23a20b5b01db7796930ef57da716a69e863a Mon Sep 17 00:00:00 2001
From: dkanada <dkanada@users.noreply.github.com>
Date: Sat, 14 Mar 2026 13:27:05 +0900
Subject: [PATCH] only pass required secrets to nested workflows

---
 .github/workflows/__deploy.yml     | 3 ++-
 .github/workflows/workflow_run.yml | 8 ++++++--
 2 files changed, 8 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/__deploy.yml b/.github/workflows/__deploy.yml
index d91ecaa896..d3effbf233 100644
--- a/.github/workflows/__deploy.yml
+++ b/.github/workflows/__deploy.yml
@@ -28,7 +28,8 @@ jobs:
     name: Progress Comment
     if: ${{ always() }}
     uses: ./.github/workflows/__job_messages.yml
-    secrets: inherit
+    secrets:
+      JF_BOT_TOKEN: ${{ secrets.JF_BOT_TOKEN }}
     with:
       branch: ${{ inputs.branch }}
       commit: ${{ inputs.commit }}
diff --git a/.github/workflows/workflow_run.yml b/.github/workflows/workflow_run.yml
index 6d72c949e5..c4ab3c39f4 100644
--- a/.github/workflows/workflow_run.yml
+++ b/.github/workflows/workflow_run.yml
@@ -32,7 +32,8 @@ jobs:
     permissions:
       contents: read
       issues: write
-    secrets: inherit
+    secrets:
+      JF_BOT_TOKEN: ${{ secrets.JF_BOT_TOKEN }}
 
   deploy:
     name: Deploy
@@ -41,7 +42,10 @@ jobs:
       contents: read
       issues: write
       deployments: write
-    secrets: inherit
+    secrets:
+      JF_BOT_TOKEN: ${{ secrets.JF_BOT_TOKEN }}
+      CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
+      CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
     needs:
     - metadata
     with: