From bbc227bc81c81e33ee7baf7a1ddc73c3c68cea87 Mon Sep 17 00:00:00 2001
From: Mohamed Boudra <boudra.moha@gmail.com>
Date: Sat, 17 Jan 2026 16:38:35 +0700
Subject: [PATCH] ci(server): wire LLM secrets and add fail-fast preflight
 validation

Add environment variables for LLM authentication:
- ANTHROPIC_API_KEY and CLAUDE_SESSION_TOKEN for Claude Code tests
- OPENAI_API_KEY for Codex and OpenCode tests

Add preflight step that validates credentials are present before running
tests. The step exits with code 1 and clear error messaging if any
required secrets are missing, preventing long hangs from auth failures.

Follows STEER guidance: does NOT set CLAUDE_CONFIG_DIR, CODEX_HOME, or
CODEX_SESSION_DIR - relies on default auth paths.
---
 .github/workflows/server-ci.yml | 37 +++++++++++++++++++++++++++++++++
 1 file changed, 37 insertions(+)

diff --git a/.github/workflows/server-ci.yml b/.github/workflows/server-ci.yml
index af9dc117b..9b83327f4 100644
--- a/.github/workflows/server-ci.yml
+++ b/.github/workflows/server-ci.yml
@@ -20,6 +20,13 @@ jobs:
   test:
     runs-on: ubuntu-latest
 
+    env:
+      # Claude authentication (required for Claude Code tests)
+      ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
+      CLAUDE_SESSION_TOKEN: ${{ secrets.CLAUDE_SESSION_TOKEN }}
+      # OpenAI authentication (required for Codex and OpenCode tests)
+      OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
+
     steps:
       - uses: actions/checkout@v4
 
@@ -28,6 +35,36 @@ jobs:
           node-version: '20'
           cache: 'npm'
 
+      - name: Preflight - Validate LLM credentials
+        run: |
+          # Fail fast if required credentials are missing
+          MISSING_VARS=()
+
+          # Claude requires EITHER ANTHROPIC_API_KEY OR CLAUDE_SESSION_TOKEN
+          if [ -z "$ANTHROPIC_API_KEY" ] && [ -z "$CLAUDE_SESSION_TOKEN" ]; then
+            MISSING_VARS+=("ANTHROPIC_API_KEY or CLAUDE_SESSION_TOKEN")
+          fi
+
+          # OpenAI API key required for Codex and OpenCode
+          if [ -z "$OPENAI_API_KEY" ]; then
+            MISSING_VARS+=("OPENAI_API_KEY")
+          fi
+
+          if [ ${#MISSING_VARS[@]} -gt 0 ]; then
+            echo "ERROR: Missing required LLM credentials for server tests"
+            echo "Please configure the following GitHub Actions secrets:"
+            for var in "${MISSING_VARS[@]}"; do
+              echo "  - $var"
+            done
+            echo ""
+            echo "Required secrets:"
+            echo "  - ANTHROPIC_API_KEY or CLAUDE_SESSION_TOKEN (for Claude Code tests)"
+            echo "  - OPENAI_API_KEY (for Codex and OpenCode tests)"
+            exit 1
+          fi
+
+          echo "✓ All required LLM credentials are configured"
+
       - name: Install server dependencies
         run: npm install --workspace=@paseo/server --include-workspace-root