Possible this workflow uses `secrets: inherit` to pass all of the calling workflow's secr… in branch_ci.yml

[begininvoke]

I think there may be a problem in .github/workflows/branch_ci.yml around line 12.

The workflow uses secrets: inherit, which automatically forwards all repository secrets to the called reusable workflow. This breaches the principle of least privilege: if the reusable workflow is malicious, compromised, or sourced from an external repo, it gains uncontrolled access to every secret (API keys, tokens, passwords). An attacker could exfiltrate or misuse these credentials, leading to data breaches, service takeover, or supply‑chain attacks. Severity is high because the impact is total compromise of secret material.

The code in question

    secrets: inherit

Something like this might fix it:

```diff
@@
-    secrets: inherit
+    secrets:
+      # Only expose the secrets that the reusable workflow actually needs
+      MY_DB_PASSWORD: ${{ secrets.MY_DB_PASSWORD }}
+      DEPLOY_TOKEN:   ${{ secrets.DEPLOY_TOKEN }}
+      # Add additional secrets here as required
```

For reference: rule yaml.github-actions.security.secrets-inherit.secrets-inherit, CWE-250 (Execution with Unnecessary Privileges). Rated high.

If I have misread how this is used, sorry for the noise — feel free to close.

---

Found with automated scanning (RedGem) and reviewed before opening. If it is not useful, closing it is completely fine.