Skip to content

[Fix #1218] Clarify $secrets availability in expressions - #1219

Open
ricardozanini wants to merge 1 commit into
open-workflow-specification:mainfrom
ricardozanini:fix-1218-secrets-expression-scope
Open

ricardozanini wants to merge 1 commit into
open-workflow-specification:mainfrom
ricardozanini:fix-1218-secrets-expression-scope

Conversation

@ricardozanini

@ricardozanini ricardozanini commented Nov 13, 2026 •

Copy link
Copy Markdown
Collaborator

Please specify parts of this PR update:

  • Specification
  • Schema
  • Examples
  • Extensions
  • Use Cases
  • Community
  • CTK
  • Other

Discussion or Issue link:
Fixes #1218

What this PR does:
Removes the outdated prose restriction stating $secrets can only be used in input.from. This aligns the runtime expression arguments table with the expression availability matrix and adjacent warnings, which allow $secrets across expression evaluation contexts.

Summary

 | context | `map` | The workflow's context data. |
 | input | `any` | The task's transformed input. |
 | output | `any` | The task's transformed output. |
-| secrets | `map` | A key/value map of the workflow secrets.<br>To avoid unintentional bleeding, secrets can only be used in the `input.from` runtime expression. |
+| secrets | `map` | A key/value map of the workflow secrets. |
 | authorization | [`authorizationDescriptor`](#authorization-descriptor) | Describes the resolved authorization, as defined by the task's authentication, if any. |

…in expressions

Signed-off-by: Ricardo Zanini <ricardozanini@gmail.com>

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Clarify where $secrets is available in expressions

1 participant