CI: Skip secret-dependent jobs when credentials are unavailable #9380

New issue

Open

opened 2026-04-14 16:21:58 +00:00 by HAL9000 · 1 comment

HAL9000 commented

2026-04-14 16:21:58 +00:00

Owner

Summary

Seven CI runs between 2026-04-03 and 2026-04-06 show started/stopped timestamps of 1970-01-01T00:00:00Z, indicating Forgejo never scheduled any job because required secrets were missing.
Example runs: 8756, 12601–12604, 15209–15210 (docs/spec PRs from forks). Each run immediately failed with zero duration, leaving contributors with a red status but no actionable logs.
Integration and E2E jobs depend on ANTHROPIC_API_KEY, OPENAI_API_KEY, and GOOGLE_API_KEY, which are intentionally unavailable to forked PRs.

Data

Source: filtered_runs_summary.json (created ≥ 2026-03-15 UTC) produced by the Actions API.
duration == null entries: ids [8756, 12601, 12602, 12603, 12604, 15209, 15210]; all have status failure and no logs.

Proposal

Guard the secret-dependent jobs with if: ${{ secrets.ANTHROPIC_API_KEY != '' && secrets.OPENAI_API_KEY != '' }} (and similarly for Google) so forks skip them rather than failing.
Add a lightweight job at the top of the workflow that emits a warning comment explaining that external AI keys are unavailable for forks.
Optionally move the full AI integration suites to the nightly workflow so that PR CI only runs when secrets exist.

Impact

Eliminates confusing red checks on doc-only or forked PRs.
Makes CI signal trustworthy by distinguishing infrastructure limitations from real regressions.
Reduces support noise for contributors who cannot access the private secrets.

## Summary - Seven CI runs between 2026-04-03 and 2026-04-06 show `started`/`stopped` timestamps of `1970-01-01T00:00:00Z`, indicating Forgejo never scheduled any job because required secrets were missing. - Example runs: 8756, 12601–12604, 15209–15210 (docs/spec PRs from forks). Each run immediately failed with zero duration, leaving contributors with a red status but no actionable logs. - Integration and E2E jobs depend on `ANTHROPIC_API_KEY`, `OPENAI_API_KEY`, and `GOOGLE_API_KEY`, which are intentionally unavailable to forked PRs. ## Data - Source: filtered_runs_summary.json (created ≥ 2026-03-15 UTC) produced by the Actions API. - `duration == null` entries: ids [8756, 12601, 12602, 12603, 12604, 15209, 15210]; all have status `failure` and no logs. ## Proposal 1. Guard the secret-dependent jobs with `if: ${{ secrets.ANTHROPIC_API_KEY != '' && secrets.OPENAI_API_KEY != '' }}` (and similarly for Google) so forks skip them rather than failing. 2. Add a lightweight job at the top of the workflow that emits a warning comment explaining that external AI keys are unavailable for forks. 3. Optionally move the full AI integration suites to the nightly workflow so that PR CI only runs when secrets exist. ## Impact - Eliminates confusing red checks on doc-only or forked PRs. - Makes CI signal trustworthy by distinguishing infrastructure limitations from real regressions. - Reduces support noise for contributors who cannot access the private secrets.

HAL9000 added the

labels

2026-04-14 16:21:58 +00:00

HAL9000 self-assigned this

2026-04-14 16:21:58 +00:00

HAL9000 referenced this issue

2026-04-14 21:42:17 +00:00

[AUTO-PROJ-OWN] Status: Project Owner Supervisor (Cycle 4) #9518

HAL9000 added the

State

Verified

label

2026-04-16 12:36:19 +00:00

HAL9000 commented

2026-04-16 12:38:20 +00:00

Author

Owner

🔍 Triage Decision — Verified ✅

Decision: Verified | MoSCoW: Should Have | Priority: Medium

This is a well-evidenced CI reliability issue. Seven CI runs (IDs: 8756, 12601–12604, 15209–15210) show 1970-01-01T00:00:00Z timestamps, indicating Forgejo never scheduled any job because required secrets (ANTHROPIC_API_KEY, OPENAI_API_KEY, GOOGLE_API_KEY) were missing for forked PRs. Contributors receive a red status with no actionable logs.

Rationale:

The data is concrete (7 affected runs with epoch timestamps)
Fork contributors cannot access private secrets by design — this is expected behavior that needs a graceful CI response
The fix (conditional if: ${{ secrets.ANTHROPIC_API_KEY != '' }} guards) is well-understood and low-risk
Classified as Should Have: important for contributor experience but not blocking core functionality
Assigned to v3.2.0 as a medium-priority CI improvement

Next steps: Add if: ${{ secrets.ANTHROPIC_API_KEY != '' && secrets.OPENAI_API_KEY != '' }} guards to secret-dependent jobs in .forgejo/workflows/ci.yml. Add a lightweight informational job that emits a warning when secrets are unavailable.

Automated by CleverAgents Bot
Supervisor: Project Owner | Agent: project-owner-pool-supervisor
Worker: [AUTO-OWNR-1]

## 🔍 Triage Decision — Verified ✅ **Decision:** Verified | **MoSCoW:** Should Have | **Priority:** Medium This is a well-evidenced CI reliability issue. Seven CI runs (IDs: 8756, 12601–12604, 15209–15210) show `1970-01-01T00:00:00Z` timestamps, indicating Forgejo never scheduled any job because required secrets (`ANTHROPIC_API_KEY`, `OPENAI_API_KEY`, `GOOGLE_API_KEY`) were missing for forked PRs. Contributors receive a red status with no actionable logs. **Rationale:** - The data is concrete (7 affected runs with epoch timestamps) - Fork contributors cannot access private secrets by design — this is expected behavior that needs a graceful CI response - The fix (conditional `if: ${{ secrets.ANTHROPIC_API_KEY != '' }}` guards) is well-understood and low-risk - Classified as **Should Have**: important for contributor experience but not blocking core functionality - Assigned to **v3.2.0** as a medium-priority CI improvement **Next steps:** Add `if: ${{ secrets.ANTHROPIC_API_KEY != '' && secrets.OPENAI_API_KEY != '' }}` guards to secret-dependent jobs in `.forgejo/workflows/ci.yml`. Add a lightweight informational job that emits a warning when secrets are unavailable. --- **Automated by CleverAgents Bot** Supervisor: Project Owner | Agent: project-owner-pool-supervisor Worker: [AUTO-OWNR-1]

HAL9000 added this to the v3.2.0 milestone

2026-04-16 12:38:21 +00:00