Add workflow input to set environment variables

[haines]

We have a Go dependency that needs credentials to access. This causes the code analysis to fail:

Failed to run code analysis (govulncheck) on '/github/workspace/go.mod' because govulncheck: loading packages: 
There are errors with the provided package patterns:
pkg/database/migrations.go:15:2: riverqueue.com/riverpro/driver@v0.19.0: reading https://riverqueue.com/goproxy/riverqueue.com/riverpro/driver/@v/v0.19.0.zip: 401 Unauthorized

To fix this, we need to set

GOPROXY: https://proxy.golang.org,https://river:${{ secrets.RIVER_PRO_SECRET }}@riverqueue.com/goproxy,direct
GONOSUMDB: riverqueue.com/riverpro

Unfortunately reusable workflows don't inherit the top-level env setting from the calling workflow. It would be nice if this could be an input to the reusable workflows.

EDIT: The secrets context is not available when setting inputs to reusable workflows; to make this possible I think this means the workflows would need to be extracted to composite actions 😖

[another-rex]

Unfortunately reusable workflows don't inherit the top-level env setting from the calling workflow. It would be nice if this could be an input to the reusable workflows.

EDIT: The secrets context is not available when setting inputs to reusable workflows; to make this possible I think this means the workflows would need to be extracted to composite actions 😖

That is quite inconvenient.

We do have most of the core logic inside separate github actions (e.g. google/osv-scanner-action/osv-scanner-action@v...), see https://github.com/google/osv-scanner-action/blob/main/.github/workflows/osv-scanner-reusable.yml on how to use it directly. Would it work for you to copy the reusable workflow implementation and directly rely on the github action itself?

[haines]

I don't think it's possible to provide environment variables to the action itself as it stands?

We can copy the reusable workflow implementation but it'd be a bit of a pain keeping it up to date. If there were a composite action (and the reusable workflow just had one step that calls that composite action) then it'd be a lot easier to consume. I'd be happy to submit a PR.

[another-rex]

Happy to accept a PR to do this, I was mostly using reusable workflow as I wasn't aware of a good alternative to get what we needed.