fix(ci): claude review workflow never triggered due to secrets in step if

[peter-near]

The claude PR review workflow added in #15996 never ran: the secrets context is not allowed in step-level if: expressions, which made the whole workflow file invalid. GitHub could not parse it, so every push produced a failed zero-job stub run and the actual pull_request / issue_comment triggers never fired.

Expose ANTHROPIC_API_KEY through job-level env (where the secrets context is allowed) and check env.ANTHROPIC_API_KEY in the step condition instead. Validated with actionlint.

[Copilot]

Pull request overview

This PR fixes the Claude PR review GitHub Actions workflow so it can be parsed and triggered properly by removing use of the secrets context in a step-level if: expression. It does this by surfacing ANTHROPIC_API_KEY via the env context and then checking env.ANTHROPIC_API_KEY in the step condition.

Changes:

• Add job-level env.ANTHROPIC_API_KEY sourced from ${{ secrets.ANTHROPIC_API_KEY }}.
• Update the Claude review step to gate on env.ANTHROPIC_API_KEY and pass the key via env instead of secrets.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 73.04%. Comparing base (63f0e19) to head (484f0dc).

Additional details and impacted files

@@            Coverage Diff             @@
##           master   #16018      +/-   ##
==========================================
- Coverage   73.05%   73.04%   -0.02%     
==========================================
  Files         856      856              
  Lines      186825   186825              
  Branches   186825   186825              
==========================================
- Hits       136482   136462      -20     
- Misses      45975    45991      +16     
- Partials     4368     4372       +4     

Flag	Coverage Δ
pytests-nightly	1.23% <ø> (ø)
unittests	69.68% <ø> (-0.01%)	⬇️
unittests-nightly	69.70% <ø> (+<0.01%)	⬆️
unittests-spice	65.29% <ø> (-0.02%)	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[github-actions]

Pull request overview

The claude-pr-review.yml workflow shipped in #15996 never fired because it used ${{ secrets.ANTHROPIC_API_KEY }} inside a step-level if: expression, which GitHub Actions rejects — so the whole workflow file was invalid and every push produced a zero-job stub run. This PR replaces the check with a dedicated pre-checkout step that records only the presence of the key as a step output, and gates the review step on that output. It also passes github_token explicitly to the Claude action so it doesn't try to mint a token via the (uninstalled) Claude Code GitHub App.

Changes:

• Added a Check for API key step (before checkout) that writes present=true/empty to $GITHUB_OUTPUT using ${VAR:+true} bash expansion — the secret itself is never emitted, only its presence.
• Switched the Run Claude Code Review step's if: from secrets.ANTHROPIC_API_KEY != '' to steps.key-check.outputs.present == 'true'.
• Added github_token: ${{ github.token }} to the action inputs to bypass the GitHub App token minting path.

Reviewed changes

Per-file summary

File	Description
.github/workflows/claude-pr-review.yml	Add pre-checkout key-check step, gate review on its output, pass github_token to the Claude action.

Findings

No blocking issues.

Notes on the fix:

• ${ANTHROPIC_API_KEY:+true} correctly expands to true only when the secret is set to a non-empty value, otherwise nothing — so the output never carries the secret's value.
• Scoping the secret to a single pre-checkout step (rather than job-level env:) directly addresses the earlier Copilot feedback about broad secret exposure to steps executing checked-out code.
• The secrets context is still permitted inside with: (only if: at step level rejects it), so the actual anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }} input remains valid.

✅ Approved