Reduce scope of ci secrets

Author: spoorcc

.github/workflows/ci.yml

@@ -43,13 +43,15 @@ jobs:
     uses: ./.github/workflows/test.yml
     permissions:
       contents: read
-    secrets: inherit
+    secrets:
+      CODACY_PROJECT_TOKEN: ${{ secrets.CODACY_PROJECT_TOKEN }}
 
   docs:
     needs: prep-release
     uses: ./.github/workflows/docs.yml
     permissions:
       contents: write
-    secrets: inherit
+    secrets:
+      GH_DFETCH_ORG_DEPLOY: ${{ secrets.GH_DFETCH_ORG_DEPLOY }}
     with:
       release_id: ${{ needs.prep-release.outputs.release_id }}

.github/workflows/docs.yml

@@ -7,6 +7,9 @@ on:
         required: false
         type: string
         default: ''
+    secrets:
+      GH_DFETCH_ORG_DEPLOY:
+        required: false
 
 permissions:
   contents: read

.github/workflows/test.yml

@@ -2,6 +2,9 @@ name: Test
 
 on:
   workflow_call:
+    secrets:
+      CODACY_PROJECT_TOKEN:
+        required: false
 
 permissions:
   contents: read