fix(claude-assistant): prevent startup_failure by making secret optional - #11
Merged
twistedmelonman merged 1 commit intoMar 8, 2026
Conversation
When a reusable workflow declares a secret as required: true, GitHub validates it at workflow dispatch time — before any jobs run. This means even runs where the calling job would be skipped (e.g. because @claude was not mentioned) cause startup_failure for the entire workflow, not just that job. Root cause: required: true triggers dispatch-level validation. The calling job passes the secret conditionally, but GitHub can't satisfy the required constraint before job conditions are evaluated. Fix: required: false prevents dispatch-time validation. If Claude is triggered and the secret is genuinely missing, the Claude Code action will fail at runtime with a clear authentication error, which is actionable. The no-op case (no @claude mention) now correctly shows as skipped rather than startup_failure. Investigated by tracing kebab-tax run history: startup_failure began at run #1848, coinciding exactly with the adoption of claude-assistant.yml. All runs showed jobs: [] (zero jobs started), confirming workflow dispatch failure rather than a job-level issue. Closes startup_failure regression in consumers using claude-assistant.yml@v1. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
twistedmelonman
deleted the
claude/fix-startup-failure-required-secret-20260307
branch
August 8, 2026 01:12
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Root Cause
claude-assistant.ymldeclaredclaude_oauth_tokenasrequired: true. GitHub validatesrequired: truesecrets at workflow dispatch time — before any jobs run. This means every run that triggers theclaude.ymlworkflow (even when@claudeisn't mentioned) hits this validation gate and gets reported asstartup_failure, with zero jobs started (jobs: []).This was traced by examining kebab-tax run history:
skipped(inlineclaude.yml, norequired:constraint)startup_failure(switched toclaude-assistant.yml@v1withrequired: true)The gate-job pattern (PR kebab-tax#908) didn't help because the secret is validated at dispatch time, before job conditions are evaluated.
Fix
required: false— GitHub skips dispatch-time secret validation. If@claudeis triggered and the secret is genuinely missing, the Claude Code action fails at runtime with a clear authentication error. For non-@clauderuns, the calling job is properly skipped.Test Plan
v1tag: verify kebab-tax runs for non-@claudeevents showskipped(notstartup_failure)@claudeevents still work correctly🤖 Generated with Claude Code