ci: skip warden when app credentials are unavailable

Author: shuofengzhang

.github/workflows/warden.yml

@@ -11,9 +11,9 @@ on:
 
 jobs:
   review:
-    # Only run for same-owner branches; external forks won't have access
-    # to app credentials and would fail token generation.
-    if: ${{ github.event.pull_request.head.repo.owner.login == github.repository_owner }}
+    # Only run for same-repo branches and when GitHub App credentials exist.
+    # Fork PRs do not receive secrets; skip cleanly instead of failing token generation.
+    if: ${{ github.event.pull_request.head.repo.full_name == github.repository && secrets.WARDEN_APP_ID != '' && secrets.WARDEN_PRIVATE_KEY != '' }}
     runs-on: ubuntu-latest
     env:
       WARDEN_ANTHROPIC_API_KEY: ${{ secrets.WARDEN_ANTHROPIC_API_KEY }}