fix(ci): do not shadow local agy auth with an empty GEMINI_API_KEY #39

Problem

The reusable agy-review.yml always exports:

env:
  GEMINI_API_KEY: ${{ secrets.GEMINI_API_KEY || secrets.AGY_API_KEY }}

When neither secret is available to the caller, GitHub materializes this as an empty environment variable. On the self-hosted agy-reviewer runner that shadows the CLI's local/default authentication path and agy exits non-zero.

This has been masked in repositories where blocking: false: the reusable workflow's continue-on-error path posts/records a non-blocking failure and the overall job still appears green. It became visible immediately when mctlhq/mctl-gitops#1073 switched Agy to blocking: true; both the old head and the follow-up head failed with GEMINI_API_KEY: empty in the job log.

secrets: inherit in the caller does not help when no matching secret is actually exposed to that repository.

Desired behavior

• If GEMINI_API_KEY / AGY_API_KEY is non-empty, export it for agy.
• If neither secret is present, do not set an empty GEMINI_API_KEY; leave the variable unset so the self-hosted runner's supported local/default auth path can be used.
• If no auth path works, fail with an explicit auth diagnostic rather than a generic reviewer failure.
• Non-blocking mode must still make reviewer execution failure visible in the PR comment/evidence; it must not look like a successful independent review.

Acceptance criteria

• Reusable Agy workflow does not set GEMINI_API_KEY to an empty string.
• Secret-backed auth continues to work when a secret is supplied.
• Local/default runner auth works when no secret is supplied.
• A truly unauthenticated runner fails with an explicit diagnostic.
• blocking: true fails closed on reviewer/auth failure.
• blocking: false remains non-blocking but clearly records that no valid Agy review was produced.
• Test/fixture covers secret present, secret absent with local auth, and no auth.

Concrete evidence

• mctlhq/mctl-gitops#1073, head f1de7ad5: agy-review / review failed with GEMINI_API_KEY: empty even after the caller added secrets: inherit.
• The same reusable behavior is currently masked by non-blocking callers such as mctlhq/mctl-telegram.

Related

• fix(ci): govern auto-merge by green checks and clean reviews mctl-gitops#1073
• roadmap(devloop): adopt blocking-review PRs that have no proposal owner #38 (durable remediation ownership for PRs)