#122 gave the reusable workflow an explicit workflow_call secret contract so
XAI_API_KEY would stop arriving empty. That fixed the model key and quietly
broke every caller-provided skill: SECRETS_JSON is toJSON(secrets), so it now
contains only the secrets this contract declares, and a skill's setup.sh finds
nothing under the names its own repo uses.
homelab's node1-ssh skill is the live casualty. Its setup.sh reads SWARM_HOST,
SWARM_USER and SSH_PRIV_KEY_B64, takes the "not set -- skipping node1 SSH alias"
path, and exits 0; the agent then loads the skill, is told it may run
`ssh node1 ...`, and gets nothing. @senior hit exactly this while diagnosing the
immich crash-loop in homelab #301 and had to fall back to a blind version
revert. The failure is silent by design -- the skip is what lets a fork run
without deploy secrets -- so nothing in the run says the capability is gone.
Declaring the three optional here is the smallest fix that keeps the contract.
It is not a general one: secret names for caller skills are by definition known
only to the caller, and an explicit contract cannot express that, so each new
caller-skill secret has to be added alongside these.
Also fixes two pieces of drift that would spread the same breakage: the header
still told callers to use `secrets: inherit`, and README's copy-me stub still
showed it, so the next repo onboarded would have arrived with no model key.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01CYFnHida4AdiNDek2pzgXx
Cross-owner reusable calls left XAI_API_KEY empty in the runner while
OLLAMA_CLOUD_API_KEY worked. Declare secrets on workflow_call, accept
alternate secret names, log key lengths (not values), and ship an
ai-agent.yml caller template with an explicit secrets map.
Repo transferred ffaerber/agents -> gitea/agents. Point the scripts checkout (agent.yml
repository:), the standard caller (uses:), and the README at gitea/agents. The trigger gate still
keys on the maintainer 'ffaerber' (unchanged).
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Bare '#' starts a YAML comment, so run-name resolved to 'ai-agent ·' with the number dropped.
Quote the value.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Without run-name, Gitea titles each ai-agent run by main's head commit, so runs aren't identifiable
in the Actions list. Add `run-name: ai-agent · #${{ github.event.issue.number }}` to the standard
caller (both the file and the README stub) so each run shows its issue.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
The caller workflow had drifted between repos (run-name, stale SHA comment, trigger ordering,
different comment text) though all were functionally the same `uses: agent.yml@main`. Define one
canonical stub: make this repo's own ai-agent.yml the reference and update the README "Use it in a
repo" block to match it verbatim, noting that the on: triggers and the jobs.agent wrapper are the
irreducible minimum for a reusable (workflow_call) workflow.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
hermes
junior