Skip secret validation for workflow_call

languageservice/src/context-providers/secrets.ts

@@ -11,10 +11,12 @@ export function getSecretsContext(workflowContext: WorkflowContext, mode: Mode):
     description: getDescription("secrets", "GITHUB_TOKEN")
   });
 
-  if (mode === Mode.Completion) {
-    const eventsConfig = workflowContext?.template?.events;
-    if (eventsConfig?.workflow_call?.secrets) {
-      for (const [name, value] of Object.entries(eventsConfig.workflow_call.secrets)) {
+  const eventsConfig = workflowContext?.template?.events;
+  if (eventsConfig?.workflow_call) {
+    // Unpredictible secrets may be pased in via a workflow_call trigger
+    d.complete = false;
+    if (mode === Mode.Completion) {
+      for (const [name, value] of Object.entries(eventsConfig.workflow_call.secrets || {})) {
         d.add(name, new StringData(""), value.description);
       }
     }

languageservice/src/validate.expressions.test.ts

@@ -98,6 +98,25 @@ jobs:
     ]);
   });
 
+  it("no secret validation with workflow_call", async () => {
+    const input = `
+on:
+  workflow_call:
+    secrets:
+      my_secret:
+env:
+  my_secret: \${{ secrets.my_secret }}
+  secret: \${{ secrets.secret-not-exist }}
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - run: echo`;
+
+    const result = await validate(createDocument("wf.yaml", input));
+    expect(result).toEqual([]);
+  });
+
   it("access invalid nested context field", async () => {
     const result = await validate(
       createDocument(