Summary

Reusable workflows don't auto-inherit secrets — only the vars context. The AWS account ID was the one setting that forced every caller of reusable-backstage-techdocs.yml to keep a secrets: block (or secrets: inherit, which the org Security suite flags via zizmor secrets-inherit).

Since an account ID is a non-sensitive identifier — and the org now has a TECHDOCS_AWS_ACCOUNT_ID variable — this adds a vars fallback to the account-ID cascade:

AWS_ACCOUNT_ID: ${{ secrets.AWS_ACCOUNT_ID || secrets.TECHDOCS_AWS_ACCOUNT_ID || vars.AWS_ACCOUNT_ID || vars.TECHDOCS_AWS_ACCOUNT_ID }}

Back-compat: secrets are tried first, so existing secrets: / secrets: inherit callers are unaffected. Callers relying on the org variable can now drop the secrets: block entirely:

jobs:
  publish:
    permissions:            # irreducible — OIDC requires the caller to grant id-token: write
      contents: read
      id-token: write
    uses: geolonia/.github/.github/workflows/reusable-backstage-techdocs.yml@<sha>  # vX

Also updates the secret-input descriptions to point at the vars alternative.

Closes #94

Test plan

• YAML valid
• Cascade tries secrets before vars (no behavior change for existing callers)
• After merge: a consumer with the org variable set and no secrets: block publishes TechDocs successfully (verify on the first repo we simplify)

Follow-up

Simplify individual consumers to drop their secrets: block (e.g. geonicdb-infra-cdk's publish-techdocs.yml), once this lands.

Summary by CodeRabbit

• Documentation

  • Clarified the recommended way to provide AWS account IDs, with guidance to use repository or organization variables when available.

• Bug Fixes

  • Improved the default AWS account selection order so it now falls back more reliably when building the OIDC role ARN.