From 06730736bba1d3458d85041ee8d3ed71cd3eeb01 Mon Sep 17 00:00:00 2001
From: santisoutoo <santiago.souto.01@uie.edu>
Date: Mon, 24 Aug 2026 20:31:55 +0200
Subject: [PATCH] fix: stop referencing secrets directly in a step if:
 condition
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

PR #101 changed the "Install Cursor CLI" step's `if:` to
`secrets.CURSOR_API_KEY != ''`. GitHub rejects that at workflow_dispatch
validation time with "Unrecognized named-value: 'secrets'" (HTTP 422),
hit for real trying to re-dispatch issue #85 after merging the
run-engine.sh timeout fix. This silently broke every future trigger of
agent-loop.yml, including the 06/13/20 UTC cron.

pick-issue.sh already computes CURSOR_AVAILABLE from the secret inside
its own env (the allowed pattern — secrets flow through env:, never
directly in if:). Expose it as a step output (cursor_available) and gate
the Cursor CLI install on that instead.
---
 .github/agent/pick-issue.sh      | 12 ++++++++++--
 .github/workflows/agent-loop.yml |  6 +++++-
 2 files changed, 15 insertions(+), 3 deletions(-)

diff --git a/.github/agent/pick-issue.sh b/.github/agent/pick-issue.sh
index 6235733..61311db 100755
--- a/.github/agent/pick-issue.sh
+++ b/.github/agent/pick-issue.sh
@@ -8,8 +8,15 @@
 # is granted to anyone with a merged PR).
 #
 # Outputs (to $GITHUB_OUTPUT): empty=true|false, number, title, branch_prefix,
-# engine, model. The issue body is written to $RUNNER_TEMP/issue-body.md — it
-# is data for the worker prompt, never evaluated by the shell.
+# engine, model, cursor_available=true|false. The issue body is written to
+# $RUNNER_TEMP/issue-body.md — it is data for the worker prompt, never
+# evaluated by the shell.
+#
+# cursor_available exists so later steps can gate an `if:` on whether the
+# secret is configured WITHOUT referencing `secrets` directly in a step
+# `if:` — GitHub rejects that at workflow-dispatch validation time with
+# "Unrecognized named-value: 'secrets'" (hit for real in agent-loop.yml,
+# 2026-08-24, PR #101).
 #
 # Engine routing: frontend issues go to Cursor (Codex-class models on the
 # Cursor subscription); everything else goes to OpenCode Go. If CURSOR_API_KEY
@@ -142,6 +149,7 @@ main() {
     echo "branch_prefix=$(derive_branch_prefix "$labels")"
     echo "engine=$engine"
     echo "model=$(derive_model "$engine" "$labels")"
+    echo "cursor_available=${CURSOR_AVAILABLE:-false}"
   } >> "$GITHUB_OUTPUT"
   echo "Picked #$number ($title)"
 }
diff --git a/.github/workflows/agent-loop.yml b/.github/workflows/agent-loop.yml
index 05b25ba..162bc0a 100644
--- a/.github/workflows/agent-loop.yml
+++ b/.github/workflows/agent-loop.yml
@@ -135,7 +135,11 @@ jobs:
         # Needed whenever the secret exists, not only when the worker routes
         # to Cursor: the reviewer's frontier cascade (below) tries Cursor's
         # "Other Models" pool first regardless of which engine implemented.
-        if: steps.pick.outputs.empty == 'false' && secrets.CURSOR_API_KEY != ''
+        # Gated on steps.pick.outputs.cursor_available, NOT `secrets.` directly:
+        # GitHub rejects a step `if:` that references the secrets context with
+        # "Unrecognized named-value: 'secrets'" at workflow-dispatch validation
+        # time (broke this exact line in PR #101, discovered 2026-08-24).
+        if: steps.pick.outputs.empty == 'false' && steps.pick.outputs.cursor_available == 'true'
         run: |
           curl -fsS https://cursor.com/install | bash
           echo "$HOME/.local/bin" >> "$GITHUB_PATH"