fix(ci): clear residual workflow startup_failures (secrets-in-if, hashFiles-in-job-if) (#363)

## What

Fixes the workflow **`startup_failure`** classes that fail *before any
job runs* and were **left on `main` after #360/#361**. Rebased onto
current `main` (`bec6161`); now scoped to exactly the two remaining root
causes.

## Why this is still needed after #360 / #361

#360 added `timeout-minutes` + fixed changelog YAML; #361 added more
`timeout-minutes` + fixed two malformed workflows. Neither addressed the
two `startup_failure` causes below — I re-verified both are still
present on `bec6161`. (Where they overlapped, the upstream fixes are
kept: `changelog-reusable.yml` and `boj-build.yml`'s malformed YAML are
already fixed upstream, so they drop out of this PR.)

## Fixes

### 1. `secrets` context in `if:` → *"Unrecognized named-value:
'secrets'"* (parse-time startup failure)

| File | Before | Fix |
|---|---|---|
| `boj-build.yml` | job-level `if: …secrets.BOJ_SERVER_URL…` | **Drop
the job `if`** — the Trigger step already self-gates (exits 0 on empty
`BOJ_URL`), so the job is a cheap no-op when unconfigured. |
| `instant-sync.yml` | step `if: secrets.FARM_DISPATCH_TOKEN …` (×2) |
Map secret → job-level `env`, gate steps on `env.FARM_DISPATCH_TOKEN`. |
| `mirror-reusable.yml` (`mirror-radicle`) | step `if:
secrets.RADICLE_KEY …` (×4) | Map secret → job-level `env`, gate steps
on `env.RADICLE_KEY`. |

`env` **is** available in step `if:` and secrets **are** valid in
job-level `env` — this is the canonical presence-gate pattern and is
correct whether or not `secrets`-in-`if` parses, so it can't regress a
working file.

### 2. `hashFiles()` in a **job-level** `if:` (always `''` → job
silently skipped on every repo)

Job `if:` is evaluated server-side **before checkout**, so
`hashFiles(...)` sees an empty workspace and returns `''` — meaning
`rust-ci`/`elixir-ci` skipped on **every** consumer, Rust/Elixir or not.

- `rust-ci-reusable.yml` (×4) and `elixir-ci-reusable.yml` (×1): add a
small **`detect`** job that checks out and exports a real boolean
(`has_cargo` / `has_mix`); the real jobs gate on
`needs.detect.outputs.*`. Behaviour preserved; the guard actually works
now. (Step-level `with: hashFiles(mix.lock)` for caching is untouched —
that runs on the runner and is fine.)

## Verification

- All 5 files parse as YAML.
- `git grep 'if:.*secrets\.'` over all workflows → **none**.
- `git grep 'if:.*hashFiles'` over all workflows → **none** (step-level
`with:` usages remain, correctly).

## Known Hypatia scan findings (no action — see below)

The non-blocking Hypatia scan reports
`secret_action_without_presence_gate` on:

- **`instant-sync.yml` · `peter-evans/repository-dispatch` (high)** —
**false-positive introduced by this PR's correct fix.** The rule
pattern-matches a literal `secrets.X != ''` gate on the step; I replaced
it with `env.FARM_DISPATCH_TOKEN != ''` precisely because
`secrets`-in-`if` is the `startup_failure` being fixed. The presence
gate genuinely still exists (env mapped from the secret) — Hypatia just
doesn't recognise the env-indirection. Satisfying the rule would mean
reintroducing the real startup failure, so **GitHub correctness wins**.
The proper root fix is to teach Hypatia's
`secret_action_without_presence_gate` rule to accept an
`env`-mapped-from-`secret` gate (separate change in the `hypatia` repo).
- **`mirror-reusable.yml` · `webfactory/ssh-agent` (high, ×2)** —
pre-existing (GITEA key), unrelated to this PR; a hygiene flag, not a
`startup_failure`.

## Registry-verify on this PR

The `Registry + topology in sync` check is red here, but **not because
of this PR** — these five edits are all top-level `.github/workflows/*`
files (no spec home), adding zero registry drift. It's the
**pre-existing `main` drift that #366 fixes** (inherited because this
branched off `main`). Once #366 lands, a rebase clears it. Deliberately
not regenerating the registry here, to avoid colliding with #366.

Consumers pin the reusables by SHA, so callers are unaffected until they
bump their pin.

https://claude.ai/code/session_0178nMYCNXgotTeekePkoUjd

Co-authored-by: Claude <noreply@anthropic.com>

Author: hyperpolymath

.github/workflows/boj-build.yml

@@ -19,7 +19,11 @@ jobs:
   trigger-boj:
     runs-on: ubuntu-latest
     timeout-minutes: 10
-    if: ${{ vars.BOJ_SERVER_URL != '' || secrets.BOJ_SERVER_URL != '' }}
+    # No job-level gate: the `secrets` context is not available in `if:`
+    # (referencing it is an "Unrecognized named-value: 'secrets'" startup
+    # failure). The Trigger step below already self-gates — it exits 0 when
+    # BOJ_URL (secret-or-var) is empty — so the whole job is a cheap no-op
+    # when unconfigured.
     steps:
       - name: Checkout
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

.github/workflows/elixir-ci-reusable.yml

@@ -98,12 +98,41 @@ permissions:
   contents: read
 
 jobs:
+  # Guard on mix.exs so the wrapper is safe to add unconditionally. This must
+  # be a checked-out step, NOT a job-level `if: hashFiles(...)`: job `if:` is
+  # evaluated server-side before any checkout, so hashFiles() sees an empty
+  # workspace and always returns '' — which silently skipped the test job on
+  # EVERY repo, Elixir or not. The detect job checks out and exposes a real
+  # boolean output the test job gates on.
+  detect:
+    timeout-minutes: 5
+    name: Detect mix.exs
+    runs-on: ${{ inputs.runs-on }}
+    permissions:
+      contents: read
+    outputs:
+      has_mix: ${{ steps.detect.outputs.has_mix }}
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          repository: ${{ github.repository }}
+          ref: ${{ github.ref }}
+      - name: Detect mix.exs
+        id: detect
+        run: |
+          if [ -f "${{ inputs.working_directory }}/mix.exs" ]; then
+            echo "has_mix=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "has_mix=false" >> "$GITHUB_OUTPUT"
+          fi
+
   test:
     timeout-minutes: 20
     name: Compile + test
     runs-on: ${{ inputs.runs-on }}
-    # Guard on mix.exs so the wrapper is safe to add unconditionally.
-    if: ${{ hashFiles(format('{0}/mix.exs', inputs.working_directory)) != '' }}
+    needs: detect
+    if: ${{ needs.detect.outputs.has_mix == 'true' }}
     permissions:
       contents: read
     env:

.github/workflows/instant-sync.yml

@@ -15,6 +15,12 @@ jobs:
   dispatch:
     timeout-minutes: 10
     runs-on: ubuntu-latest
+    # Map the secret to env so step `if:`s can gate on its presence: the
+    # `secrets` context is NOT available in `if:` (using it is an
+    # "Unrecognized named-value: 'secrets'" startup failure). `env` IS
+    # available in step `if:`, and secrets are valid in job-level `env`.
+    env:
+      FARM_DISPATCH_TOKEN: ${{ secrets.FARM_DISPATCH_TOKEN }}
     steps:
       # Gate the cross-repo repository_dispatch on FARM_DISPATCH_TOKEN
       # being configured. Without the PAT, peter-evans/repository-dispatch
@@ -24,7 +30,7 @@ jobs:
       # gracefully skips on repos where the secret has not been
       # propagated, instead of red-ing main on every push.
       - name: Trigger Propagation
-        if: ${{ secrets.FARM_DISPATCH_TOKEN != '' }}
+        if: ${{ env.FARM_DISPATCH_TOKEN != '' }}
         uses: peter-evans/repository-dispatch@28959ce8df70de7be546dd1250a005dd32156697 # v3
         with:
           token: ${{ secrets.FARM_DISPATCH_TOKEN }}
@@ -39,7 +45,7 @@ jobs:
             }
 
       - name: Skipped (FARM_DISPATCH_TOKEN not configured)
-        if: ${{ secrets.FARM_DISPATCH_TOKEN == '' }}
+        if: ${{ env.FARM_DISPATCH_TOKEN == '' }}
         env:
           REPO_NAME: ${{ github.event.repository.name }}
         run: |

.github/workflows/mirror-reusable.yml

@@ -159,6 +159,12 @@ jobs:
     timeout-minutes: 20
     runs-on: ${{ inputs.runs-on }}
     if: vars.RADICLE_MIRROR_ENABLED == 'true'
+    # Map the secret to env so step `if:`s can gate on its presence: the
+    # `secrets` context is NOT available in `if:` (using it is an
+    # "Unrecognized named-value: 'secrets'" startup failure). `env` IS
+    # available in step `if:`, and secrets are valid in job-level `env`.
+    env:
+      RADICLE_KEY: ${{ secrets.RADICLE_KEY }}
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
@@ -174,23 +180,23 @@ jobs:
       # answers "is Radicle mirror desired here?"; the secret gate
       # answers "are we configured to actually do it?".
       - name: Setup Rust
-        if: ${{ secrets.RADICLE_KEY != '' }}
+        if: ${{ env.RADICLE_KEY != '' }}
         uses: dtolnay/rust-toolchain@efa25f7f19611383d5b0ccf2d1c8914531636bf9 # stable
         with:
           toolchain: stable
       - name: Install Radicle
-        if: ${{ secrets.RADICLE_KEY != '' }}
+        if: ${{ env.RADICLE_KEY != '' }}
         run: |
           cargo install radicle-cli --locked
           echo "$HOME/.cargo/bin" >> $GITHUB_PATH
       - name: Mirror to Radicle
-        if: ${{ secrets.RADICLE_KEY != '' }}
+        if: ${{ env.RADICLE_KEY != '' }}
         run: |
           mkdir -p ~/.radicle/keys
           echo "${{ secrets.RADICLE_KEY }}" > ~/.radicle/keys/radicle
           chmod 600 ~/.radicle/keys/radicle
           rad sync --announce || echo "Radicle sync attempted"
       - name: Skipped (RADICLE_KEY not configured)
-        if: ${{ secrets.RADICLE_KEY == '' }}
+        if: ${{ env.RADICLE_KEY == '' }}
         run: |
           echo "::notice::RADICLE_MIRROR_ENABLED=true but secrets.RADICLE_KEY is empty. Skipping Radicle mirror. Configure the RADICLE_KEY org/repo secret to enable."

.github/workflows/rust-ci-reusable.yml

@@ -100,14 +100,42 @@ permissions:
   contents: read
 
 jobs:
-  # Skip the whole reusable when the repo has no Cargo.toml — lets
-  # consumers add the wrapper unconditionally without worrying about
-  # repos that don't ship Rust code at the moment.
+  # Skip the whole reusable when the repo has no Cargo.toml — lets consumers
+  # add the wrapper unconditionally without worrying about repos that don't
+  # ship Rust code yet. This MUST be a checked-out step, NOT a job-level
+  # `if: hashFiles(...)`: job `if:` is evaluated server-side before any
+  # checkout, so hashFiles() sees an empty workspace and always returns ''
+  # — which silently skipped every job on EVERY repo, Rust or not. The
+  # detect job checks out and exposes a real boolean the others gate on.
+  detect:
+    timeout-minutes: 5
+    name: Detect Cargo.toml
+    runs-on: ${{ inputs.runs-on }}
+    permissions:
+      contents: read
+    outputs:
+      has_cargo: ${{ steps.detect.outputs.has_cargo }}
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          repository: ${{ github.repository }}
+          ref: ${{ github.ref }}
+      - name: Detect Cargo.toml
+        id: detect
+        run: |
+          if [ -f "${{ inputs.working_directory }}/Cargo.toml" ]; then
+            echo "has_cargo=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "has_cargo=false" >> "$GITHUB_OUTPUT"
+          fi
+
   check:
     timeout-minutes: 20
     name: Cargo check + clippy + fmt
     runs-on: ${{ inputs.runs-on }}
-    if: ${{ hashFiles(format('{0}/Cargo.toml', inputs.working_directory)) != '' }}
+    needs: detect
+    if: ${{ needs.detect.outputs.has_cargo == 'true' }}
     permissions:
       contents: read
     defaults:
@@ -147,8 +175,8 @@ jobs:
     timeout-minutes: 20
     name: Cargo test
     runs-on: ${{ inputs.runs-on }}
-    needs: check
-    if: ${{ hashFiles(format('{0}/Cargo.toml', inputs.working_directory)) != '' }}
+    needs: [detect, check]
+    if: ${{ needs.detect.outputs.has_cargo == 'true' }}
     permissions:
       contents: read
     defaults:
@@ -187,7 +215,8 @@ jobs:
     timeout-minutes: 20
     name: Cargo audit (security)
     runs-on: ${{ inputs.runs-on }}
-    if: ${{ inputs.enable_audit && hashFiles(format('{0}/Cargo.toml', inputs.working_directory)) != '' }}
+    needs: detect
+    if: ${{ inputs.enable_audit && needs.detect.outputs.has_cargo == 'true' }}
     permissions:
       contents: read
     defaults:
@@ -216,7 +245,8 @@ jobs:
     timeout-minutes: 20
     name: Coverage (tarpaulin + codecov)
     runs-on: ${{ inputs.runs-on }}
-    if: ${{ inputs.enable_coverage && hashFiles(format('{0}/Cargo.toml', inputs.working_directory)) != '' }}
+    needs: detect
+    if: ${{ inputs.enable_coverage && needs.detect.outputs.has_cargo == 'true' }}
     permissions:
       contents: read
     defaults: