Degrade instead of failing when no token is available - #25
Conversation
Every open Dependabot PR in this repo (#1-#5) is red, and none of them for anything to do with the bumps: --from-parser-artifacts needs GH_TOKEN or GITHUB_TOKEN ##[error]Process completed with exit code 1 Dependabot PRs and fork PRs receive NO repository secrets - not a redacted value, an empty string - so the provisioning step hard-fails for a reason the PR author cannot fix. They were then triaged as "CI failing, hold", which read as a judgement on the dependencies rather than on our workflow. Adopts the pattern intentumdiff-core already uses: detect HAS_SPLIT_TOKEN at job level, where secrets ARE readable (`secrets.*` cannot be referenced from a step-level `if:`) gate provisioning and the full suite on it degrade run what CAN run when the token is absent announce ::notice:: saying exactly what was skipped and why The announcement is not decoration. A quiet reduced gate is indistinguishable from a full one, and someone will eventually merge on it believing the whole suite ran. That is the failure this repo already knows: 0.0.1 shipped green while covering less than it appeared to. The full gate still runs on every maintainer branch PR and on the base branch, so nothing merges without it having passed somewhere. The reduced path exists for people who cannot supply a secret - never as a convenience. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 30c8401f55
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| # resolves to 'unknown' and the suite cannot run. Fail-closed: a missing or | ||
| # unverified component stops the job here rather than an hour later as mass | ||
| # PluginNotFoundError failures. | ||
| if: env.HAS_SPLIT_TOKEN == 'true' |
There was a problem hiding this comment.
On every fork or Dependabot run without this secret, this condition skips the only step that creates build/intentumdiff-core, but the following pip install -e .[dev,serve] still invokes maturin with manifest-path = "build/intentumdiff-core/crates/rust-core-host/Cargo.toml". That directory is not tracked, so the editable install fails on the missing manifest and the newly added reduced pytest step is never reached; the no-token jobs therefore remain red rather than degrading. Separate token-independent engine staging from parser-artifact provisioning, or install a usable prebuilt backend for the reduced suite.
AGENTS.md reference: AGENTS.md:L9-L9
Useful? React with 👍 / 👎.
1 participant
All five open Dependabot PRs (#1–#5) are red, and none of them because of the bumps.
Dependabot PRs and fork PRs receive no repository secrets — not a redacted value, an empty string. So the provisioning step hard-fails for a reason the PR author cannot fix, and the PRs then get triaged as "CI failing, hold" — which reads as a judgement on the dependencies rather than on our workflow.
The fix
Adopts the pattern
intentumdiff-corealready uses:HAS_SPLIT_TOKENat job level, where secrets are readable (secrets.*cannot be referenced from a step-levelif:)::notice::stating exactly what was skipped and whyThe announcement is not decoration. A quiet reduced gate is indistinguishable from a full one, and someone will eventually merge on it believing the whole suite ran. That is the failure this repo already knows: 0.0.1 shipped green while covering less than it appeared to.
What is deliberately not done
The reduced path is never the default. The full gate runs on every maintainer branch PR and on the base branch, so nothing merges without it having passed somewhere. The reduced path exists for people who cannot supply a secret — not as a convenience, and not as a way to make a red build go away.
Verification
ci.ymlparses;HAS_SPLIT_TOKENis set at job level and three steps gate on it. The proof is the Dependabot PRs themselves: once this lands they should go green on their own merits, and if any is genuinely broken that will now be visible instead of buried.🤖 Generated with Claude Code