Handle missing HUGGING_FACE_TOKEN gracefully in CI (#1480)

Only export the token when it has a non-empty value. This prevents
the 'httpx.LocalProtocolError: Illegal header value b'Bearer '' error
that occurs when Dependabot PRs run without access to secrets.

The token is passed via an intermediate env var (HF_TOKEN_VALUE) and
only exported to HUGGING_FACE_TOKEN if non-empty, allowing tests that
don't need microdata downloads to still pass.

Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>

Author: MaxGhenis

.github/workflows/code_changes.yaml

@@ -50,9 +50,14 @@ jobs:
           - name: UV sync
             run: uv sync
           - name: Run tests with coverage
-            run: make test
+            run: |
+              # Only export token if non-empty (defensive against missing secrets)
+              if [ -n "$HF_TOKEN_VALUE" ]; then
+                export HUGGING_FACE_TOKEN="$HF_TOKEN_VALUE"
+              fi
+              make test
             env:
-              HUGGING_FACE_TOKEN: ${{ secrets.HUGGING_FACE_TOKEN }}
+              HF_TOKEN_VALUE: ${{ secrets.HUGGING_FACE_TOKEN }}
           - name: Upload coverage to Codecov
             uses: codecov/codecov-action@v4
             with:

.github/workflows/pr_code_changes.yaml

@@ -50,9 +50,14 @@ jobs:
           - name: UV sync
             run: uv sync
           - name: Run tests with coverage
-            run: make test
+            run: |
+              # Only export token if non-empty (avoids 'Bearer ' error for Dependabot PRs)
+              if [ -n "$HF_TOKEN_VALUE" ]; then
+                export HUGGING_FACE_TOKEN="$HF_TOKEN_VALUE"
+              fi
+              make test
             env:
-              HUGGING_FACE_TOKEN: ${{ secrets.HUGGING_FACE_TOKEN }}
+              HF_TOKEN_VALUE: ${{ secrets.HUGGING_FACE_TOKEN }}
           - name: Upload coverage to Codecov
             uses: codecov/codecov-action@v4
             with:

changelog_entry.yaml

@@ -0,0 +1,4 @@
+- bump: patch
+  changes:
+    fixed:
+      - CI workflows now handle missing HUGGING_FACE_TOKEN gracefully, allowing Dependabot PRs to run tests without failing on empty Bearer token errors.