[workflow-health] Daily Code Debt Cleanup — Aider: OPENAI_API_KEY expired/invalid (401)

[github-actions]

Workflow Failure — Daily Code Debt Cleanup — Aider (OPENAI_API_KEY invalid)

Workflow: .github/workflows/daily-code-debt-aider.md
Run: https://github.com/github/gh-aw/actions/runs/31902558266
Pattern: 5+ consecutive failures over the last 5 days (2026-08-11 through 2026-08-15), 100% failure rate.

Root Cause

The AWF API proxy sidecar fails OpenAI key validation on every run:

{"level":"warn","event":"key_validation","provider":"openai","status":"auth_rejected","httpStatus":401}
{"level":"error","event":"key_validation_failed","provider":"openai","message":"OPENAI API key validation failed — HTTP 401 — token expired or invalid. Rotate the secret and re-run."}

aider_harness.cjs then throws Error: Aider execution failed and the job exits with code 1 before any Aider work can run.

Impact

• daily-code-debt-aider.md is 100% broken (5/5 recent runs failed) — no code-debt cleanup PRs are being produced.
• Any other workflow depending on the OPENAI_API_KEY secret via the api-proxy sidecar (e.g. Aider-engine workflows) is at risk of the same failure. daily-go-test-stubs-aider.md currently succeeds, suggesting it may not exercise the OpenAI provider path, but should be verified once the key is rotated.

Suggested Fix

1. Rotate/renew the OPENAI_API_KEY repository secret used by the Aider engine's api-proxy sidecar.
2. After rotation, re-run daily-code-debt-aider manually to confirm the key validates (key_validation event should report status":"valid").
3. Consider adding a lightweight secret-expiry alert (e.g. periodic key validation check) so future rotations aren't discovered only via workflow run failures.

Priority: P1

Not causing cascading failures, but is a 100%-broken scheduled workflow with a clear, actionable root cause (expired credential).

Generated by 🏥 Workflow Health Manager - Meta-Orchestrator · auto · 79.8 AIC · ⌖ 3.53 AIC · ⊞ 11.8K · ◷

• expires on Aug 16, 2026, 8:45 PM UTC-08:00