What the check does
Fires only on workflows triggered bypull_request_target or workflow_run. Within those, it flags a job that calls a reusable workflow (a job-level uses:) with secrets: inherit.
secrets: inherit passes every secret available to the calling workflow into the called one.
Why it matters
Under a privileged trigger the calling workflow already runs in an attacker-influenced context.secrets: inherit then widens the blast radius from “the secrets this job needs” to “every secret in the repository/organization”: the called workflow — and any untrusted code it ends up running — can reach all of them. Passing only the specific secrets a reusable workflow needs keeps a single compromise from yielding the full secret store.