[chicks-net]

Problem

The Validate App Spec workflow has been failing on every run with "workflow file issue" — no jobs executed and no logs were produced (the logs API returned 404).

actionlint pinpointed the cause:

.github/workflows/validate-app-spec.yml:22:18: context "secrets" is not allowed here
.github/workflows/validate-app-spec.yml:41:17: context "secrets" is not allowed here
.github/workflows/validate-app-spec.yml:47:17: context "secrets" is not allowed here

Per GitHub's context-availability table, the secrets context is not permitted in steps.if — only github, needs, strategy, matrix, job, runner, env, vars, steps, inputs are. GitHub has been enforcing this more strictly, so the workflow now refuses to load.

Fix

Move the secret-presence check into a job-level env: var (where secrets is allowed per the same table), then branch the three steps on env.HAS_DO_TOKEN:

env:
  HAS_DO_TOKEN: ${{ secrets.DIGITALOCEAN_ACCESS_TOKEN != '' }}

Behavior is preserved: without a token the YAML syntax check runs; with a token doctl apps spec validate runs instead.

Verification

• actionlint .github/workflows/validate-app-spec.yml → exit 0, no findings
• Confirmed secrets is listed for jobs.<job_id>.env but not jobs.<job_id>.steps.if in the docs table

[Copilot]

Pull request overview

Fixes a GitHub Actions workflow-load failure in Validate App Spec by removing use of the secrets context from steps.if (which causes the workflow to be rejected at parse time) and replacing it with a job-level env flag derived from the secret.

Changes:

• Adds a job-level env.HAS_DO_TOKEN computed from secrets.DIGITALOCEAN_ACCESS_TOKEN.
• Updates step conditions to branch on env.HAS_DO_TOKEN instead of referencing secrets in steps.if.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.