bugfix: make workflow_call.secrets.*.required optional

src/workflow/event.rs

@@ -265,6 +265,7 @@ pub struct WorkflowCallOutput {
 #[serde(rename_all = "kebab-case")]
 pub struct WorkflowCallSecret {
     pub description: Option<String>,
+    #[serde(default)]
     pub required: bool,
 }
 

tests/sample-workflows/zizmor-issue-646.yml

@@ -0,0 +1,15 @@
+# https://github.com/woodruffw/zizmor/issues/646
+
+name: Test
+
+on:
+  workflow_call:
+    secrets:
+      my-secret:
+        description: My secret
+
+jobs:
+  job:
+    runs-on: ubuntu-latest
+    steps:
+      - run: echo ${{ secrets.my-secret }}