Skip to content

fix: stop referencing secrets directly in a step if: condition #103

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
Santisoutoo merged 1 commit into from
Aug 24, 2026
+15 −3
Merged

fix: stop referencing secrets directly in a step if: condition #103

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
12 changes: 10 additions & 2 deletions .github/agent/pick-issue.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,8 +8,15 @@
# is granted to anyone with a merged PR).
#
# Outputs (to $GITHUB_OUTPUT): empty=true|false, number, title, branch_prefix,
# engine, model. The issue body is written to $RUNNER_TEMP/issue-body.md — it
# is data for the worker prompt, never evaluated by the shell.
# engine, model, cursor_available=true|false. The issue body is written to
# $RUNNER_TEMP/issue-body.md — it is data for the worker prompt, never
# evaluated by the shell.
#
# cursor_available exists so later steps can gate an `if:` on whether the
# secret is configured WITHOUT referencing `secrets` directly in a step
# `if:` — GitHub rejects that at workflow-dispatch validation time with
# "Unrecognized named-value: 'secrets'" (hit for real in agent-loop.yml,
# 2026-08-24, PR #101).
#
# Engine routing: frontend issues go to Cursor (Codex-class models on the
# Cursor subscription); everything else goes to OpenCode Go. If CURSOR_API_KEY
Expand Down Expand Up @@ -142,6 +149,7 @@ main() {
echo "branch_prefix=$(derive_branch_prefix "$labels")"
echo "engine=$engine"
echo "model=$(derive_model "$engine" "$labels")"
echo "cursor_available=${CURSOR_AVAILABLE:-false}"
} >> "$GITHUB_OUTPUT"
echo "Picked #$number ($title)"
}
Expand Down
6 changes: 5 additions & 1 deletion .github/workflows/agent-loop.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -135,7 +135,11 @@ jobs:
# Needed whenever the secret exists, not only when the worker routes
# to Cursor: the reviewer's frontier cascade (below) tries Cursor's
# "Other Models" pool first regardless of which engine implemented.
if: steps.pick.outputs.empty == 'false' && secrets.CURSOR_API_KEY != ''
# Gated on steps.pick.outputs.cursor_available, NOT `secrets.` directly:
# GitHub rejects a step `if:` that references the secrets context with
# "Unrecognized named-value: 'secrets'" at workflow-dispatch validation
# time (broke this exact line in PR #101, discovered 2026-08-24).
if: steps.pick.outputs.empty == 'false' && steps.pick.outputs.cursor_available == 'true'
run: |
curl -fsS https://cursor.com/install | bash
echo "$HOME/.local/bin" >> "$GITHUB_PATH"
Expand Down