From 25fc4077125c3b6dcceca9883361b549455e5ffd Mon Sep 17 00:00:00 2001
From: Brendan Kellam <brendan@sourcebot.dev>
Date: Tue, 4 Aug 2026 18:59:04 -0700
Subject: [PATCH] fix: pass reusable workflow input from event

---
 .github/scripts/test-cve-remediation.sh | 15 +++++++++++++--
 .github/workflows/cve-remediation.yml   |  2 +-
 2 files changed, 14 insertions(+), 3 deletions(-)

diff --git a/.github/scripts/test-cve-remediation.sh b/.github/scripts/test-cve-remediation.sh
index 5c15eaf79..5e87681c1 100755
--- a/.github/scripts/test-cve-remediation.sh
+++ b/.github/scripts/test-cve-remediation.sh
@@ -5,6 +5,7 @@ SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 FILTER="$SCRIPT_DIR/filter-unlinked-cve-issues.jq"
 DISCOVERY_SCRIPT="$SCRIPT_DIR/find-unlinked-cve-issues.sh"
 WORKFLOW_FILE="$SCRIPT_DIR/../workflows/_cve-remediation.yml"
+CALLER_WORKFLOW_FILE="$SCRIPT_DIR/../workflows/cve-remediation.yml"
 
 assert_json() {
   local description="$1"
@@ -22,8 +23,9 @@ assert_json() {
 assert_workflow_contains() {
   local description="$1"
   local expected="$2"
+  local workflow_file="${3:-$WORKFLOW_FILE}"
 
-  if ! grep -Fq -- "$expected" "$WORKFLOW_FILE"; then
+  if ! grep -Fq -- "$expected" "$workflow_file"; then
     echo "FAIL: $description"
     echo "Expected workflow to contain: $expected"
     exit 1
@@ -33,8 +35,9 @@ assert_workflow_contains() {
 assert_workflow_not_contains() {
   local description="$1"
   local unexpected="$2"
+  local workflow_file="${3:-$WORKFLOW_FILE}"
 
-  if grep -Fq -- "$unexpected" "$WORKFLOW_FILE"; then
+  if grep -Fq -- "$unexpected" "$workflow_file"; then
     echo "FAIL: $description"
     echo "Expected workflow not to contain: $unexpected"
     exit 1
@@ -276,5 +279,13 @@ assert_workflow_not_contains \
 assert_workflow_not_contains \
   "does not use unavailable job workflow SHA context" \
   'job.workflow_sha'
+assert_workflow_contains \
+  "passes a numeric manual or scheduled issue limit through an allowed context" \
+  "fromJSON(github.event.inputs.max_issues || '50')" \
+  "$CALLER_WORKFLOW_FILE"
+assert_workflow_not_contains \
+  "does not use the unavailable inputs context in a reusable workflow call" \
+  '${{ inputs.max_issues' \
+  "$CALLER_WORKFLOW_FILE"
 
 echo "All CVE remediation tests passed."
diff --git a/.github/workflows/cve-remediation.yml b/.github/workflows/cve-remediation.yml
index 76a31d1eb..e0985cf92 100644
--- a/.github/workflows/cve-remediation.yml
+++ b/.github/workflows/cve-remediation.yml
@@ -26,5 +26,5 @@ jobs:
   remediate:
     uses: ./.github/workflows/_cve-remediation.yml
     with:
-      max_issues: ${{ inputs.max_issues || 50 }}
+      max_issues: ${{ fromJSON(github.event.inputs.max_issues || '50') }}
     secrets: inherit