From c769ee1f7443869307ed00618446a65b372f87ba Mon Sep 17 00:00:00 2001
From: begininvoke <56797886+begininvoke@users.noreply.github.com>
Date: Wed, 19 Aug 2026 00:31:19 -0700
Subject: [PATCH] fix(security): This workflow uses `secrets: inherit` to pass
 all of the calling workflow's secrets to a reusable workflo

---
 .github/workflows/build-docker.yml | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/build-docker.yml b/.github/workflows/build-docker.yml
index 20a15a01f..b0a027303 100644
--- a/.github/workflows/build-docker.yml
+++ b/.github/workflows/build-docker.yml
@@ -17,7 +17,9 @@ env:
 jobs:
   tests:
     uses: ./.github/workflows/run-tests.yml
-    secrets: inherit
+    secrets:
+      DOCKER_USERNAME: ${{ secrets.DOCKER_USERNAME }}
+      DOCKER_PASSWORD: ${{ secrets.DOCKER_PASSWORD }}
 
   build:
     needs: [tests]
@@ -108,4 +110,4 @@ jobs:
             $(printf '${{ env.IMAGE }}@sha256:%s ' *)
 
       - name: Inspect image
-        run: docker buildx imagetools inspect ${{ env.IMAGE }}:${{ github.sha }}
+        run: docker buildx imagetools inspect ${{ env.IMAGE }}:${{ github.sha }}
\ No newline at end of file