Felix FaerberandClaude Opus 5
e29b8141f8
ci / lint (pull_request) Successful in 17s
#122 gave the reusable workflow an explicit workflow_call secret contract so XAI_API_KEY would stop arriving empty. That fixed the model key and quietly broke every caller-provided skill: SECRETS_JSON is toJSON(secrets), so it now contains only the secrets this contract declares, and a skill's setup.sh finds nothing under the names its own repo uses. homelab's node1-ssh skill is the live casualty. Its setup.sh reads SWARM_HOST, SWARM_USER and SSH_PRIV_KEY_B64, takes the "not set -- skipping node1 SSH alias" path, and exits 0; the agent then loads the skill, is told it may run `ssh node1 ...`, and gets nothing. @senior hit exactly this while diagnosing the immich crash-loop in homelab #301 and had to fall back to a blind version revert. The failure is silent by design -- the skip is what lets a fork run without deploy secrets -- so nothing in the run says the capability is gone. Declaring the three optional here is the smallest fix that keeps the contract. It is not a general one: secret names for caller skills are by definition known only to the caller, and an explicit contract cannot express that, so each new caller-skill secret has to be added alongside these. Also fixes two pieces of drift that would spread the same breakage: the header still told callers to use `secrets: inherit`, and README's copy-me stub still showed it, so the next repo onboarded would have arrived with no model key. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01CYFnHida4AdiNDek2pzgXx