fixup! Inherit secrets from caller workflow [full tests] [extended te…

…sts] [trigger downstream]

Signed-off-by: Spencer Wilson <[email protected]>

.github/workflows/commit-to-main.yml

@@ -14,6 +14,8 @@ jobs:
 
   scorecard:
     uses: ./.github/workflows/scorecard.yml
+    secrets: inherit
 
   basic-downstream:
     uses: ./.github/workflows/downstream-basic.yml
+    secrets: inherit

.github/workflows/pr.yml

@@ -21,3 +21,4 @@ jobs:
   scorecard:
     needs: basic-checks
     uses: ./.github/workflows/scorecard.yml
+    secrets: inherit

.github/workflows/push.yml

@@ -30,3 +30,4 @@ jobs:
     needs: basic-checks
     if: contains( github.event.head_commit.message, '[trigger downstream]' )
     uses: ./.github/workflows/downstream-release.yml
+    secrets: inherit

.github/workflows/weekly.yml

@@ -13,6 +13,7 @@ jobs:
   # https://github.com/ossf/scorecard/blob/main/docs/checks.md#maintained
   scorecard:
     uses: ./.github/workflows/scorecard.yml
+    secrets: inherit
 
   extended-tests:
     uses: ./.github/workflows/extended.yml

CI.md

@@ -87,13 +87,19 @@ Currently, these include
 - [`liboqs-go`](https://github.com/open-quantum-safe/liboqs-go)
 - [`liboqs-python`](https://github.com/open-quantum-safe/liboqs-python)
 
+Callers must include `secrets: inherit` in order for the appropriate access tokens to be passed to this workflow.
+
 #### <a name="downstream-release.yml"></a> Downstream release trigger (`downstream-release.yml`)
 
-This workflow triggers release tests for a selection of projects that depend on `liboqs`. Currently, this is only the [`OQS OpenSSL3 provider`](https://github.com/open-quantum-safe/oqs-provider).
+This workflow triggers release tests for a selection of projects that depend on `liboqs`.
+Currently, this is only the [`OQS OpenSSL3 provider`](https://github.com/open-quantum-safe/oqs-provider).
+Callers must include `secrets: inherit` in order for the appropriate access tokens to be passed to this workflow.
 
 #### <a name="scorecard.yml"></a> OpenSSF scorecard analysis (`scorecard.yml`)
 
-This workflow runs the [OpenSSF scorecard](https://github.com/ossf/scorecard) tool. It is additionally triggered automatically when branch protection rules are changed.
+This workflow runs the [OpenSSF scorecard](https://github.com/ossf/scorecard) tool.
+It is additionally triggered automatically when branch protection rules are changed.
+Callers must include `secrets: inherit` in order for the appropriate access tokens to be passed to this workflow.
 
 ## Travis CI