fix(agents): declare workflow_call secrets + diagnose empty XAI_API_KEY

Cross-owner reusable calls left XAI_API_KEY empty in the runner while OLLAMA_CLOUD_API_KEY worked. Declare secrets on workflow_call, accept alternate secret names, log key lengths (not values), and ship an ai-agent.yml caller template with an explicit secrets map.
2026-07-30 16:47:13 +03:00
parent 58db2996ad
commit 9dc1c203cb
3 changed files with 51 additions and 3 deletions
@@ -5,6 +5,14 @@
 #   NAME SKILLS GITHUB_PATH HOME
 set -eu

+# Non-secret diagnostics — prove which provider keys reached the runner (length only).
+echo "provider key lengths: OLLAMA_URL=${#OLLAMA_URL} OLLAMA_CLOUD_API_KEY=${#OLLAMA_CLOUD_API_KEY} XAI_API_KEY=${#XAI_API_KEY}"
+if [ -z "${XAI_API_KEY:-}" ]; then
+  echo "WARNING: XAI_API_KEY is empty in this job. xai-oc fallback will fail."
+  echo "Fix: set Actions secret XAI_API_KEY on the CALLER repo (e.g. ffaerber/homelab),"
+  echo "not only on gitea/agents. Name must be exact: XAI_API_KEY"
+fi
+
 # PIN the opencode version: an unpinned `latest` means a breaking release (CLI flags, or the
 # --format json event schema that build-activity-log.sh parses) breaks every agent in every repo
 # at once. Bump deliberately by changing this default (or set OPENCODE_VERSION in the step env).