Github Action environment secret can't be access - deployment

Question

I want to do deployments with Github Action into 2 different AKS Cluster. I have set up repository level secrets and a prod environment level secret.
I have nested workflows:
name: Production Deployment
on:
workflow_dispatch:
push:
tags:
- prod/v.**
jobs:
deploy-prod-environment:
// HERE I CAN'T USE THE environment:prod, error from github
name: Production deployment
uses: XXXX/.github/workflows/step_deployment.yaml#master
with:
environment: prod
kubernetes_namespace: XXX
secrets:
REGISTRY_GITHUB_TOKEN: ${{ secrets.REGISTRY_GITHUB_TOKEN }}
CLIENT_ID: ${{ secrets.CLIENT_ID }}
CLIENT_SECRET: ${{ secrets.CLIENT_SECRET }}
SUBSCRIPTION_ID: ${{ secrets.SUBSCRIPTION_ID }}
TENANT_ID: ${{ secrets.TENANT_ID }}
CLUSTER_NAME: ${{ secrets.CLUSTER_NAME }}
RESOURCE_GROUP: ${{ secrets.RESOURCE_GROUP }}
GITHUB_ACTOR: ${{ github.actor }}
REGISTRY: ${{ secrets.REGISTRY }}
This is then the step_deployment.yaml
name: Deploy to a specific environment
on:
workflow_call:
inputs:
environment:
type: string
required: true
...
secrets:
REGISTRY_GITHUB_TOKEN:
required: true
CLIENT_ID:
required: true
CLIENT_SECRET:
required: true
SUBSCRIPTION_ID:
required: true
TENANT_ID:
required: true
GITHUB_ACTOR:
required: true
CLUSTER_NAME:
required: true
RESOURCE_GROUP:
required: true
REGISTRY:
required: true
jobs:
....
building the docker images
....
release:
name: 🚀Release
uses: XXX/.github/workflows/step_release.yaml#master
needs: [docker-image-builds ]
with:
environment: ${{ inputs.environment }}
sha: ${{ github.sha }}
kubernetes_namespace: ${{ inputs.kubernetes_namespace }}
secrets:
GITHUB_ACTOR: ${{ github.actor }}
CLIENT_ID: ${{ secrets.CLIENT_ID }}
CLIENT_SECRET: ${{ secrets.CLIENT_SECRET }}
SUBSCRIPTION_ID: ${{ secrets.SUBSCRIPTION_ID }}
TENANT_ID: ${{ secrets.TENANT_ID }}
CLUSTER_NAME: ${{ secrets.CLUSTER_NAME }}
RESOURCE_GROUP: ${{ secrets.RESOURCE_GROUP }}
and this is the step_release.yaml
name: Release
on:
workflow_call:
inputs:
environment:
required: true
type: string
sha:
required: true
type: string
kubernetes_namespace:
required: true
type: string
secrets:
CLIENT_ID:
required: true
CLIENT_SECRET:
required: true
SUBSCRIPTION_ID:
required: true
TENANT_ID:
required: true
GITHUB_ACTOR:
required: true
CLUSTER_NAME:
required: true
RESOURCE_GROUP:
required: true
jobs:
log-in-to-azure-and-deploy:
name: Login into Azure cluster and set the right context
runs-on: ubuntu-latest
environment: ${{ inputs.environment }}
steps:
- uses: actions/checkout#v3
- name: Azure login
id: login
uses: azure/login#v1.4.3
with:
creds: '{"clientId":"${{ secrets.CLIENT_ID }}","clientSecret":"${{ secrets.CLIENT_SECRET }}","subscriptionId":"${{ secrets.SUBSCRIPTION_ID }}","tenantId":"${{ secrets.TENANT_ID }}"}'
........
In the step_release.yaml I was able to specify on job level the environment and the protection works - it asks for a confirmation before deployment, this is perfect - but I can't get the secrets for PROD env, github says always, that I have no access to it inside the steps and in the main workflow it's always the repository level env vars.
How can I access there already the prod environment secrets?