fix: use env vars instead of secrets in step-level if conditions

[FutureUnreal]

GitHub Actions does not support secrets context in step-level if expressions. Move secret checks to job-level env variables and reference them via env.* in step conditions.

Affected workflows:

• claude-issue-duplicate-check.yml
• codex-issue-triage.yml

变更说明

关联 Issue / 需求

自测方式

• 后端：cd backend && uv run uvicorn app.main:app --reload --port 8090
• 前端：cd frontend && pnpm --filter @whalewhisper/web dev

风险 & 回滚

Checklist

• 已保证改动聚焦（不混杂无关重构）
• 已更新相关文档（如 README / 配置示例）
• 未提交任何密钥/个人信息
• CI（PR Checks）通过

📝 PR 说明（Codex 自动生成）

• 变更概览：调整 Issue 自动化工作流的“是否配置 API Key”判断方式：在 job 级别新增 HAS_ANTHROPIC_KEY / HAS_OPENAI_KEY 环境变量，并用它统一控制后续 steps 执行。涉及 .github/workflows/claude-issue-duplicate-check.yml 与 .github/workflows/codex-issue-triage.yml（共 2 个文件，14+/10-）。
• 影响范围：ci
• 如何验证：
  1. 不配置（或移除）仓库 Secrets：ANTHROPIC_API_KEY / OPENAI_API_KEY，新建一个 issue，确认对应 workflow 运行后只执行 Skip (missing …) step，后续 steps 均被跳过
  2. 配置相应 Secrets 后再新建 issue，确认 workflow 会继续执行 Checkout、以及 Claude/Codex 对应的 action steps；同时 codex-issue-triage 仅在 final-message 非空时才会进入 “Apply labels and upsert comment”
• 风险点：条件判断改为对 env 字符串 'true' 的比较；若 GitHub Actions 对布尔表达式写入 env 的字符串表现变化，可能导致 steps 误跳过/误执行（仅影响 CI 工作流）

[qodo-code-review]

Review Summary by Qodo

Fix step-level if conditions using env vars instead of secrets

🐞 Bug fix

Walkthroughs

Description

• Replace unsupported secrets context in step-level if conditions
• Move secret checks to job-level env variables
• Update step conditions to reference env.* variables
• Affects two GitHub Actions workflows for issue processing

Diagram

flowchart LR
  A["Step-level if conditions<br/>with secrets context"] -->|"Move to job-level env"| B["Job env variables<br/>with secret checks"]
  B -->|"Reference in steps"| C["Step conditions<br/>using env.* syntax"]

Loading

File Changes

1. .github/workflows/claude-issue-duplicate-check.yml 🐞 Bug fix +7/-5

Replace secrets context with env variable checks

• Added job-level env variable HAS_ANTHROPIC_KEY to check for API key presence
• Updated 4 step-level if conditions to use env.HAS_ANTHROPIC_KEY instead of
 secrets.ANTHROPIC_API_KEY
• Maintains same logic: skip steps when API key is not configured

.github/workflows/claude-issue-duplicate-check.yml

---

2. .github/workflows/codex-issue-triage.yml 🐞 Bug fix +7/-5

Replace secrets context with env variable checks

• Added job-level env variable HAS_OPENAI_KEY to check for API key presence
• Updated 4 step-level if conditions to use env.HAS_OPENAI_KEY instead of
 secrets.OPENAI_API_KEY
• Maintains same logic: skip steps when API key is not configured

.github/workflows/codex-issue-triage.yml

---

[qodo-code-review]

Code Review by Qodo

🐞 Bugs (0) 📘 Rule violations (0) 📎 Requirement gaps (0)

Great, no issues found!

Qodo reviewed your code and found no material issues that require review

ⓘ The new review experience is currently in Beta. Learn more

[greptile-apps]

Greptile Overview

Greptile Summary

Fixed GitHub Actions limitation where secrets context cannot be used in step-level if expressions by moving secret existence checks to job-level environment variables.

Changes:

• Added HAS_ANTHROPIC_KEY env variable in claude-issue-duplicate-check.yml to evaluate secrets.ANTHROPIC_API_KEY != '' at job level
• Added HAS_OPENAI_KEY env variable in codex-issue-triage.yml to evaluate secrets.OPENAI_API_KEY != '' at job level
• Updated all step-level if conditions to reference env.HAS_*_KEY instead of directly checking secrets.*
• Maintained same logical behavior: steps execute only when API key is configured

This resolves the documented GitHub Actions constraint that prevents secrets.* access in step if expressions while preserving the original skip logic for unconfigured secrets.

Confidence Score: 5/5

• This PR is safe to merge with minimal risk
• The changes are straightforward and correct: they address a documented GitHub Actions limitation by moving secret checks from step-level (where secrets context is prohibited) to job-level environment variables. The logic is preserved exactly, just relocated to a supported context. Both workflows follow identical patterns and the implementation is consistent.
• No files require special attention

Important Files Changed

Filename	Overview
.github/workflows/claude-issue-duplicate-check.yml	Correctly moves secret check from step-level if conditions to job-level env variable, resolving GitHub Actions limitation
.github/workflows/codex-issue-triage.yml	Correctly moves secret check from step-level if conditions to job-level env variable, resolving GitHub Actions limitation

Sequence Diagram

sequenceDiagram
    participant GHA as GitHub Actions
    participant Job as Workflow Job
    participant Env as Job Env Variables
    participant Steps as Workflow Steps
    
    Note over GHA,Steps: Issue Opened Event Triggered
    
    GHA->>Job: Initialize job
    Job->>Env: Set HAS_ANTHROPIC_KEY/HAS_OPENAI_KEY
    Note over Env: Evaluate secrets.API_KEY != ''<br/>Store as 'true' or 'false' string
    
    alt Secret is not configured
        Env-->>Steps: HAS_*_KEY = 'false'
        Steps->>Steps: Skip step: echo "API_KEY not configured"
        Steps->>Steps: Skip all subsequent steps
    else Secret is configured
        Env-->>Steps: HAS_*_KEY = 'true'
        Steps->>Steps: Checkout repository
        Steps->>Steps: Ensure labels exist
        Steps->>Steps: Load prompt
        Steps->>Steps: Run AI action (Claude/Codex)
        Steps->>GHA: Post comment or label to issue
    end

Loading

[github-actions]

Status

• gh can’t connect to api.github.com from this runner, so I couldn’t apply labels or post PR review/comments automatically (commands below are for running from an environment with GitHub API access).

PR Size

• XS — Lines changed: 24 (14 additions + 10 deletions), Files changed: 2

Findings (diff-only)

• No reportable issues found (no defects meeting the >=80 confidence threshold) in the changed workflow lines.

Suggested gh commands

REPO="datawhalechina/whale-whisper"
PR="20"

# Phase 2: size label
gh pr edit "$PR" --repo "$REPO" --add-label "size/XS"

# Phase 7: summary review
gh pr review "$PR" --repo "$REPO" --comment --body "$(cat <<'EOF'
## 🤖 Codex PR Review

No significant issues identified in this PR. Changes are limited to `.github/workflows/*` conditional gating logic.

### PR Size: XS
- **Lines changed**: 24
- **Files changed**: 2

### Issues Found

| Category | Critical | High | Medium | Low |
|----------|----------|------|--------|-----|
| Logic/Bugs | 0 | 0 | 0 | 0 |
| Security | 0 | 0 | 0 | 0 |
| Error Handling | 0 | 0 | 0 | 0 |
| Types | 0 | 0 | 0 | 0 |
| Comments/Docs | 0 | 0 | 0 | 0 |
| Tests | 0 | 0 | 0 | 0 |
| Simplification | 0 | 0 | 0 | 0 |

### Review Coverage
- [x] Logic and correctness
- [x] Security (OWASP Top 10)
- [x] Error handling
- [x] Type safety
- [x] Documentation accuracy
- [x] Test coverage
- [x] Code clarity

---
*Automated review by Codex AI*
EOF
)"