Merge pull request 'Let caller-provided skills receive their secrets again' (#125) from ai/caller-skill-secrets into main

Reviewed-on: #125

.gitea/workflows/agent.yml

@@ -1,9 +1,46 @@
 name: agent
 # Reusable AI-agent workflow, shared across repos. A caller repo triggers on issue_comment/issues
-# and invokes this via:  uses: gitea/agents/.gitea/workflows/agent.yml@main  (secrets: inherit).
+# and invokes this via:  uses: gitea/agents/.gitea/workflows/agent.yml@main  (explicit secret map,
+# see .gitea/workflows/ai-agent.yml for the stub every caller copies).
 # The gate + steps run in the caller's event context (github.event.* / github.repository are the caller's).
 on:
   workflow_call:
+    # Explicit secret contract so callers can map secrets by name (more reliable than
+    # secrets: inherit alone on some Gitea versions / cross-owner reusable workflows).
+    secrets:
+      GITEA_TOKEN:
+        required: true
+      OLLAMA_URL:
+        required: false
+      OLLAMA_CLOUD_API_KEY:
+        required: false
+      XAI_API_KEY:
+        required: false
+      TOKEN_PM:
+        required: false
+      TOKEN_SENIOR:
+        required: false
+      TOKEN_JUNIOR:
+        required: false
+      TOKEN_LEAD:
+        required: false
+      TOKEN_QA:
+        required: false
+      TOKEN_OPS:
+        required: false
+      TOKEN_INTERN:
+        required: false
+      # Secrets for caller-provided skills (.gitea/agent-skills/<name>/setup.sh). Their names are
+      # known only to the caller repo, but SECRETS_JSON below is toJSON(secrets) and can therefore
+      # only ever contain what this contract declares — so every such secret has to be listed here,
+      # optional, or the skill silently no-ops and the agent loses the capability without an error.
+      # These three are homelab's node1-ssh skill; add further caller-skill secrets alongside them.
+      SWARM_HOST:
+        required: false
+      SWARM_USER:
+        required: false
+      SSH_PRIV_KEY_B64:
+        required: false
 
 # Pinned opencode version — used to install it and to key the CI cache below.
 env:
@@ -150,7 +187,9 @@ jobs:
           SCRIPTS: ${{ runner.temp }}/agents-scripts
           OLLAMA_URL: ${{ secrets.OLLAMA_URL }}
           OLLAMA_CLOUD_API_KEY: ${{ secrets.OLLAMA_CLOUD_API_KEY }}
-          XAI_API_KEY: ${{ secrets.XAI_API_KEY }}
+          # Accept common alternate names — empty XAI_API_KEY has bitten us when the
+          # secret was stored under a slightly different key on the caller repo.
+          XAI_API_KEY: ${{ secrets.XAI_API_KEY || secrets.XAI_KEY || secrets.GROK_API_KEY || secrets.XAI_TOKEN }}
           NAME: ${{ steps.prep.outputs.name }}
           SKILLS: ${{ steps.prep.outputs.skills }}   # JSON array of skills this agent may load
         run: bash "$SCRIPTS/install-opencode.sh"
@@ -213,7 +252,7 @@ jobs:
         id: run
         env:
           SCRIPTS: ${{ runner.temp }}/agents-scripts
-          XAI_API_KEY: ${{ secrets.XAI_API_KEY }}
+          XAI_API_KEY: ${{ secrets.XAI_API_KEY || secrets.XAI_KEY || secrets.GROK_API_KEY || secrets.XAI_TOKEN }}
           # SELF_TOKEN = the RUNNING agent's OWN token (TOKEN_PM for @pm, TOKEN_OPS for @ops, …).
           # Only this agent's token is placed in its process env, so no agent can act as another.
           # Powers the gitea-api / gitea-admin skills — each agent calls Gitea as itself. Every

.gitea/workflows/ai-agent.yml

@@ -12,4 +12,22 @@ on:
 jobs:
   agent:
     uses: gitea/agents/.gitea/workflows/agent.yml@main
-    secrets: inherit
+    # Explicit secret map (plus inherit) so XAI_API_KEY / OLLAMA_* always reach the reusable
+    # workflow. secrets: inherit alone has left XAI_API_KEY empty on some Gitea cross-owner calls.
+    secrets:
+      GITEA_TOKEN: ${{ secrets.GITEA_TOKEN }}
+      OLLAMA_URL: ${{ secrets.OLLAMA_URL }}
+      OLLAMA_CLOUD_API_KEY: ${{ secrets.OLLAMA_CLOUD_API_KEY }}
+      XAI_API_KEY: ${{ secrets.XAI_API_KEY }}
+      TOKEN_PM: ${{ secrets.TOKEN_PM }}
+      TOKEN_SENIOR: ${{ secrets.TOKEN_SENIOR }}
+      TOKEN_JUNIOR: ${{ secrets.TOKEN_JUNIOR }}
+      TOKEN_LEAD: ${{ secrets.TOKEN_LEAD }}
+      TOKEN_QA: ${{ secrets.TOKEN_QA }}
+      TOKEN_OPS: ${{ secrets.TOKEN_OPS }}
+      TOKEN_INTERN: ${{ secrets.TOKEN_INTERN }}
+      # Secrets for this repo's own caller-provided skills (.gitea/agent-skills/). Unset in a repo
+      # that ships no such skill, which is harmless: the skill's setup.sh no-ops on an empty value.
+      SWARM_HOST: ${{ secrets.SWARM_HOST }}
+      SWARM_USER: ${{ secrets.SWARM_USER }}
+      SSH_PRIV_KEY_B64: ${{ secrets.SSH_PRIV_KEY_B64 }}

.gitea/workflows/scripts/install-opencode.sh

@@ -5,6 +5,14 @@
 #   NAME SKILLS GITHUB_PATH HOME
 set -eu
 
+# Non-secret diagnostics — prove which provider keys reached the runner (length only).
+echo "provider key lengths: OLLAMA_URL=${#OLLAMA_URL} OLLAMA_CLOUD_API_KEY=${#OLLAMA_CLOUD_API_KEY} XAI_API_KEY=${#XAI_API_KEY}"
+if [ -z "${XAI_API_KEY:-}" ]; then
+  echo "WARNING: XAI_API_KEY is empty in this job. xai-oc fallback will fail."
+  echo "Fix: set Actions secret XAI_API_KEY on the CALLER repo (e.g. ffaerber/homelab),"
+  echo "not only on gitea/agents. Name must be exact: XAI_API_KEY"
+fi
+
 # PIN the opencode version: an unpinned `latest` means a breaking release (CLI flags, or the
 # --format json event schema that build-activity-log.sh parses) breaks every agent in every repo
 # at once. Bump deliberately by changing this default (or set OPENCODE_VERSION in the step env).

README.md

@@ -87,7 +87,12 @@ on:
 jobs:
   agent:
     uses: gitea/agents/.gitea/workflows/agent.yml@main
-    secrets: inherit
+    # Explicit map, not `secrets: inherit`: inherit alone has left XAI_API_KEY empty on some Gitea
+    # cross-owner calls. Copy the full list from .gitea/workflows/ai-agent.yml, which is the stub
+    # this file abbreviates -- a secret missing from the map does not reach the workflow at all.
+    secrets:
+      GITEA_TOKEN: ${{ secrets.GITEA_TOKEN }}
+      # ... and the OLLAMA_*, XAI_API_KEY, TOKEN_* and caller-skill entries, verbatim.
 ```
 
 That's the whole per-repo footprint, and it's the minimum a caller can be: the `on:` triggers must