Use repository secret on reusable workflow input

I'm trying to use a GitHub repository secret in one of the inputs of my reusable workflow:

name: Build dbt image

on:
  push:
    paths:
      - "dbt/**"
  workflow_dispatch:

jobs:
  push-image-dev:
    name: dbt dev
    uses: ./.github/workflows/my-reusable-workflow.yml
    with:
      project_id: ${{ vars.PROJECT_ID_DEV }}
      workload_identity_provider: ${{ vars.WORKLOAD_IDENTITY_PROVIDER_DEV }}
      service_account: ${{ vars.SERVICE_ACCOUNT_DEV }}
      environment: dev
      artifact_registry_repository: docker-images
      artifact_registry_domain: europe-west4-docker.pkg.dev
      image_context: dbt
      image_name: dbt-instance
      version_file_path: dbt/version.txt
      build_args: |
        DBT_ENV_SECRET_GIT_CREDENTIAL=${{ secrets.MACHINE_USER_PAT }}

However, I'm getting this error:

The workflow is not valid. .github/workflows/ci.dbt-build.yml (Line: 23, Col: 19): Unrecognized named-value: 'secrets'. Located at position 1 within expression: secrets.MACHINE_USER_PAT

I need to pass this secret at build time so that it gets substituted in the Dockerfile while building the docker image.

Any idea how can I pass the var-name=secret-value combination in the build-args input without having to modify my reusable workflow to meet this particular usecase?

First you will have to add the secrets by going to repository settings -> secrets and variables -> actions -> New repository secret. Then add whatever secret such as MACHINE_USER_PAT

Then you will need to define the secrets in the workflow like this:

name: Build dbt image

on:
  push:
    paths:
      - "dbt/**"

workflow_dispatch:
  secrets:
     MACHINE_USER_PAT:
       required: true
     Example_secret1:
       required: true
     Example_secret2:
       required: true

jobs:
      ....

Then you can reference them in your workflow using ${{ secrets.MACHINE_USER_PAT }}

For more information here is a link to the documentation - https://docs.github.com/en/actions/security-guides/encrypted-secrets

Repository secrets are only accessible on the secrets clause of reusable workflows. I had to rewrite my workflow so that build_args were a secret instead of an input. Then, I could use the repository secret as I was trying:

name: Build dbt image

on:
  push:
    paths:
      - "dbt/**"
  workflow_dispatch:

jobs:
  push-image-dev:
    name: dbt dev
    uses: ./.github/workflows/my-reusable-workflow.yml
    with:
      project_id: ${{ vars.PROJECT_ID_DEV }}
      workload_identity_provider: ${{ vars.WORKLOAD_IDENTITY_PROVIDER_DEV }}
      service_account: ${{ vars.SERVICE_ACCOUNT_DEV }}
      environment: dev
      artifact_registry_repository: docker-images
      artifact_registry_domain: europe-west4-docker.pkg.dev
      image_context: dbt
      image_name: dbt-instance
      version_file_path: dbt/version.txt
    secrets:
      build_args: |
                DBT_ENV_SECRET_GIT_CREDENTIAL=${{ secrets.MACHINE_USER_PAT }}