From bc9325e1a3f18477adf7ae2925bc88345a46a42a Mon Sep 17 00:00:00 2001
From: Seongho Bae <me@seonghobae.me>
Date: Fri, 28 Aug 2026 14:50:03 +0900
Subject: [PATCH] fix(strix): validate provider before loading token

---
 .github/workflows/strix.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/strix.yml b/.github/workflows/strix.yml
index eb90154eae..5107cde2e9 100644
--- a/.github/workflows/strix.yml
+++ b/.github/workflows/strix.yml
@@ -651,11 +651,11 @@ jobs:
           PROVIDER_MODE: ${{ steps.gate.outputs.provider_mode }}
         run: |
           set -euo pipefail
-          source "$TRUSTED_STRIX_SOURCE/scripts/ci/load_contextual_orchestrator_token.sh"
           if [ "$PROVIDER_MODE" != "contextual_orchestrator" ]; then
             echo '::error::Strix must use the contextual-orchestrator provider.'
             exit 1
           fi
+          source "$TRUSTED_STRIX_SOURCE/scripts/ci/load_contextual_orchestrator_token.sh"
           # Sanitize CR/LF before masking to prevent broken ::add-mask::
           # commands and potential workflow command injection.
           sanitized="$(printf '%s' "${CONTEXTUAL_ORCHESTRATOR_TOKEN:-}" | tr -d '\r\n')"
@@ -673,11 +673,11 @@ jobs:
           PROVIDER_MODE: ${{ steps.gate.outputs.provider_mode }}
         run: |
           set -euo pipefail
-          source "$TRUSTED_STRIX_SOURCE/scripts/ci/load_contextual_orchestrator_token.sh"
           if [ "$PROVIDER_MODE" != "contextual_orchestrator" ]; then
             echo '::error::Strix must use the contextual-orchestrator provider.'
             exit 1
           fi
+          source "$TRUSTED_STRIX_SOURCE/scripts/ci/load_contextual_orchestrator_token.sh"
           sanitized="$(printf '%s' "${CONTEXTUAL_ORCHESTRATOR_TOKEN:-}" | tr -d '\r\n')"
           trimmed="$(printf '%s' "$sanitized" | sed 's/^[[:space:]]*//;s/[[:space:]]*$//')"
           if [ -z "$trimmed" ]; then