Rules

FP204 · secrets-inherit

`secrets: inherit` hands every repository secret to the callee; flowpact lists what is actually needed.

Code	Name	Category	Default severity
`FP204`	`secrets-inherit`	Secrets	🔵 info

Why it matters

Inherit makes the secret flow invisible: nobody can tell from the caller which secrets reach which job, and every nested workflow gets all of them.

Replace secrets: inherit with an explicit secrets: mapping of the secrets listed in the message.

uses: ./.github/workflows/deploy.yml
secrets: inherit

Change the severity (or turn the rule off) in .github/flowpact/flowpact.config.yml, by code or by name:

.github/flowpact/flowpact.config.yml

rules:
  FP204: off
  # or: secrets-inherit: error

Explain it in the terminal:

flowpact explain FP204

FP203 · unused-secret

A `workflow_call` secret is declared but never read.

FP205 · undeclared-secret-ref

A reusable workflow reads a secret it does not declare, and some caller does not use `secrets: inherit`.