From 9e2452afdb4c9471267419a95593a1cc0608edb9 Mon Sep 17 00:00:00 2001 From: "Christian M. Todie" Date: Sun, 16 Aug 2026 06:27:23 -0400 Subject: [PATCH] docs(ci): the caller must pass the secret explicitly, not inherit MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit secrets: inherit does not cross organizations. This workflow lives in cerebral-work, so an unsigned-gg caller using inherit gets an EMPTY AGENT_JURY_API_KEY and a 401 whose body reads 'No api key passed in' — which reads like a bad key rather than a missing one, and cost a round of misdiagnosis today. Proven with the same caller in four repos: both cerebral-work callers received the key and delivered verdicts; both unsigned-gg callers got nothing. The documented snippet was the source of the bad pattern, so it is corrected here as well as in the six callers already converted. --- .github/workflows/agent-jury.yml | 22 +++++++++++++++++++--- 1 file changed, 19 insertions(+), 3 deletions(-) diff --git a/.github/workflows/agent-jury.yml b/.github/workflows/agent-jury.yml index d1b2db5..c684af9 100644 --- a/.github/workflows/agent-jury.yml +++ b/.github/workflows/agent-jury.yml @@ -38,11 +38,27 @@ name: Agent Jury (reusable) # jobs: # jury: # uses: cerebral-work/.github/.github/workflows/agent-jury.yml@v1 -# secrets: inherit +# secrets: +# AGENT_JURY_API_KEY: ${{ secrets.AGENT_JURY_API_KEY }} # -# THE CREDENTIAL, AND WHY IT IS NOT UNIFORM. +# DO NOT WRITE `secrets: inherit` HERE. This workflow lives in the +# cerebral-work org, and `inherit` DOES NOT CROSS ORGANIZATIONS: a caller in +# unsigned-gg receives an EMPTY secret and the gateway answers +# 401 "Authentication Error, No api key passed in". It fails silently in the +# sense that nothing says "wrong org" — it just looks like a bad key. # -# `secrets: inherit` passes AGENT_JURY_API_KEY through. Where that key has to +# Measured 2026-08-16 with the identical caller in four repos: +# cerebral-work/cortex #65 -> verdict delivered (same org) +# cerebral-work/reverie #1671 -> verdict delivered (same org) +# unsigned-gg/vilicus #21 -> 401, key empty (cross-org) +# unsigned-gg/soma #98 -> 401, key empty (cross-org) +# +# Explicit passing works in both directions, so every caller uses it and there +# is only one caller shape to remember. +# +# THE CREDENTIAL, AND WHY ITS HOME IS NOT UNIFORM. +# +# Where the key has to # LIVE depends on the calling repo's visibility, because both orgs are on the # GitHub Free plan: #