IBM / unitxt / 37210332000

78%

push

github

CI: Don't fail fork and Dependabot runs on unavailable secrets (#1989)

GitHub withholds repository secrets from workflow runs triggered by forks
and by Dependabot. Two steps treated those secrets as mandatory and failed
hard when they resolved to an empty string, which is why PR #1986 showed 11
red jobs that never executed a single test.

The internal-dependency step wrote secrets.LLMEVALKIT_SSH_KEY to
~/.ssh/id_ed25519 and pip-installed from git+ssh://github.ibm.com. With an
empty key this aborts the whole job:

    Load key "/home/runner/.ssh/id_ed25519": error in libcrypto
    git@github.ibm.com: Permission denied (publickey).

That killed unittests, eager, and all ten preparation shards before the test
step. The host is IBM-internal, so it is unreachable from an external fork
regardless of the secret. Skip the install when no key is present. The
llmevalkit imports in metrics.py are already lazy and guarded by
_requirements_list, so the affected metrics raise a clear "install with..."
message if something actually instantiates them; everything else is
unaffected.

The Hugging Face login step interpolated an empty token into
`huggingface-cli login --token`, looped five times, and left the run
unauthenticated, which then hit the shared-runner rate limit:

    urllib.error.HTTPError: HTTP Error 429: Too Many Requests

Skip the login when no token is present and say so in the log, instead of
retrying a call that cannot succeed. Unauthenticated runs remain exposed to
Hub rate limits; this reports the cause rather than fixing it.

Both guards are no-ops on trusted runs. Prefer a guard inside the step over
continue-on-error at the call sites, so a real install failure still fails
the job when the secret IS available.

Also pass both secrets through env: rather than interpolating them into the
script body, and write the key with printf instead of echo, which mangles
values containing backslashes or a leading dash.

Signed-off-by: Yoav Katz <katz@il.ibm.co... (continued)

2785 of 4018 branches covered (69.31%)

Branch coverage included in aggregate %.

10974 of 13550 relevant lines covered (80.99%)

0.81 hits per line