CI: fork PRs can't see SCP_SPICEAI_TPCH_API_KEY, so all ten Build and test legs are permanently red

[claudespice]

cargo test runs the Flight integration test with a repository secret that fork PRs never receive, so all ten Build and test legs are permanently red on every fork PR regardless of the diff.

What happens

.github/workflows/build.yml:179-181 runs the whole suite with:

        run: cargo test
        env:
          SCP_SPICEAI_TPCH_API_KEY: ${{ secrets.SCP_SPICEAI_TPCH_API_KEY }}

GitHub withholds repository secrets from cross-fork pull_request runs, so on a fork PR the variable arrives empty and tests/client_test.rs dies at the handshake, identically on every platform and toolchain:

Error: Query execution failed: Ipc error: Can't handshake
  code: 'The request does not have valid authentication credentials', message: "API key is required"

The unit-test binary in the same job is fully green — test result: ok. 196 passed; 0 failed — while client_test reports 8 passed; 16 failed, the 16 being exactly the tests that reach the cloud endpoint. Because cargo test runs unit and integration tests in one job, that single credential-dependent test takes down all ten Build and test legs (ubuntu-latest/ubuntu-24.04/macOS × stable/beta/1.93.1) with it.

Live example: #81 has been approved and MERGEABLE since 2026-07-25 with all ten legs red for this reason alone. Nothing on that branch can clear them.

Suggested fix

Have client_test skip rather than panic when SCP_SPICEAI_TPCH_API_KEY is absent — an early return with a printed note keeps cargo test honest locally too, where contributors without a key hit the same wall. Gating the integration test on the secret's presence (rather than the whole job) preserves full coverage on trunk and on same-repo branches while letting fork PRs report on what they actually changed.

The aim is that a red Build and test means the code is broken, not that the runner had no credentials.

Related

The same fork-secrets shape makes CI permanently red on spiceai/spicepy and spiceai/spice.js fork PRs; filing separately in those repos since each harness differs.