Skip secret validation for workflow_call

languageserver/src/context-providers/secrets.ts

@@ -16,13 +16,24 @@ export async function getSecrets(
   defaultContext: DescriptionDictionary | undefined,
   mode: Mode
 ): Promise<DescriptionDictionary> {
+  const secretsContext = defaultContext || new DescriptionDictionary();
+
   const permission = await getRepoPermission(octokit, cache, repo);
   if (permission === "none") {
-    const secretsContext = defaultContext || new DescriptionDictionary();
     secretsContext.complete = false;
     return secretsContext;
   }
 
+  const eventsConfig = workflowContext?.template?.events;
+  if (eventsConfig?.workflow_call) {
+    // Unpredictible secrets may be pased in via a workflow_call trigger
+    secretsContext.complete = false;
+    // Exit early for validation mode or if workflow_call is the only trigger
+    if (mode === Mode.Validation || Object.keys(eventsConfig).length == 1) {
+      return secretsContext;
+    }
+  }
+
   let environmentName: string | undefined;
   if (workflowContext?.job?.environment) {
     if (isString(workflowContext.job.environment)) {
@@ -39,16 +50,6 @@ export async function getSecrets(
     }
   }
 
-  const secretsContext = defaultContext || new DescriptionDictionary();
-
-  // Exit early if workflow_call is the only trigger
-  if (mode === Mode.Completion) {
-    const eventsConfig = workflowContext?.template?.events;
-    if (eventsConfig?.workflow_call && Object.keys(eventsConfig).length == 1) {
-      return secretsContext;
-    }
-  }
-
   const secrets = await getRemoteSecrets(octokit, cache, repo, environmentName);
 
   // Build combined map of secrets