From 67630a7856939996f64f3a46469a39be7ac3bd99 Mon Sep 17 00:00:00 2001 From: Andrew Rich Date: Sat, 7 Mar 2026 22:23:13 -0800 Subject: [PATCH] fix(claude-assistant): change secret from required to optional MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit When a reusable workflow declares a secret as required: true, GitHub validates it at workflow dispatch time — before any jobs run. This means even runs where the calling job would be skipped (e.g. because @claude was not mentioned) cause startup_failure for the entire workflow, not just that job. Root cause: required: true triggers dispatch-level validation. The calling job passes the secret conditionally, but GitHub can't satisfy the required constraint before job conditions are evaluated. Fix: required: false prevents dispatch-time validation. If Claude is triggered and the secret is genuinely missing, the Claude Code action will fail at runtime with a clear authentication error, which is actionable. The no-op case (no @claude mention) now correctly shows as skipped rather than startup_failure. Investigated by tracing kebab-tax run history: startup_failure began at run #1848, coinciding exactly with the adoption of claude-assistant.yml. All runs showed jobs: [] (zero jobs started), confirming workflow dispatch failure rather than a job-level issue. Closes startup_failure regression in consumers using claude-assistant.yml@v1. Co-Authored-By: Claude Sonnet 4.6 --- .github/workflows/claude-assistant.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/claude-assistant.yml b/.github/workflows/claude-assistant.yml index 3d05212..39b1fbc 100644 --- a/.github/workflows/claude-assistant.yml +++ b/.github/workflows/claude-assistant.yml @@ -22,7 +22,7 @@ on: secrets: claude_oauth_token: description: 'Claude Code OAuth token (CLAUDE_CODE_OAUTH_TOKEN secret)' - required: true + required: false jobs: run: