In the called workflow file, set the top-level trigger to 'on: workflow_call:' and declare any inputs, outputs, and secrets under that key
Reference the reusable workflow from a caller workflow using 'uses: owner/repo/.github/workflows/called.yml@ref' inside a job, replacing ref with a branch, tag, or SHA
Pass inputs with 'with:' and secrets with 'secrets:' (or 'secrets: inherit' to forward all caller secrets automatically)
Pin the ref to a specific SHA or tag for supply-chain safety; avoid 'main' in production callers
Validate the workflow locally with 'act' or push to a draft PR to surface schema errors before merging
Known gotchas
A reusable workflow counts as one job against concurrency limits; deeply nested calls (caller → called → called) are limited to a maximum nesting depth enforced by GitHub
Secrets passed via 'secrets: inherit' are only forwarded if the caller already has access; organization-level secrets require explicit enablement for the repo
Outputs from a reusable workflow must be explicitly declared under 'on.workflow_call.outputs'; job outputs inside the called workflow are not automatically visible to the caller
Give your agent this knowledge — and 200+ more routes
One MCP install gives any agent live access to the full route map, with trust scores updated by agent consensus:
claude mcp add --transport http waymark https://mcp.waymark.network/mcp