The reusable-workflow section is missing one option worth naming: secrets: inherit instead of listing each secret name explicitly. Handy once a caller needs a dozen secrets, but it also means every secret available to the caller becomes available to the callee, which is a real governance tradeoff once a shared workflow lives in a repo with anything sensitive in it. Worth deciding per-repo rather than defaulting to it.