fix(ci): use k8s pod env vars for API keys instead of GitHub secrets by slin1237 · Pull Request #782 · smg-project/smg

slin1237 · 2026-03-17T06:52:23Z

Summary

Removes GitHub secret references for API keys from workflow env blocks
API keys are now injected as env vars on k8s runner pods via secretKeyRef

Problem

GitHub secrets (HF_TOKEN, OPENAI_API_KEY, CLAUDE_API_KEY, XAI_API_KEY) were removed from the repo. The workflow env blocks ANTHROPIC_API_KEY: ${{ secrets.CLAUDE_API_KEY }} resolved to empty strings, overriding the pod-level env vars and causing all external API tests to fail.

What changed

e2e-gpu-job.yml: Removed HF_TOKEN, OPENAI_API_KEY, XAI_API_KEY, ANTHROPIC_API_KEY
pr-test-rust.yml: Removed HF_TOKEN, OPENAI_API_KEY, XAI_API_KEY, ANTHROPIC_API_KEY from 3 env blocks
nightly-benchmark.yml: Removed HF_TOKEN from 3 env blocks

Test plan

E2E tests pick up API keys from pod env vars
anthropic-messages job no longer fails with "ANTHROPIC_API_KEY not set"

Summary by CodeRabbit

Chores
- Updated CI/CD workflow configurations to streamline test and benchmark execution environments.

API keys (HF_TOKEN, OPENAI_API_KEY, ANTHROPIC_API_KEY, XAI_API_KEY) are now injected as env vars directly on k8s runner pods via secretKeyRef. The workflow env: blocks were overriding pod env vars with empty strings because the GitHub secrets were removed, causing all external API tests to fail with "ANTHROPIC_API_KEY not set". What changed: - .github/workflows/e2e-gpu-job.yml: remove HF_TOKEN, OPENAI_API_KEY, XAI_API_KEY, ANTHROPIC_API_KEY from env block - .github/workflows/pr-test-rust.yml: remove HF_TOKEN, OPENAI_API_KEY, XAI_API_KEY, ANTHROPIC_API_KEY from 3 env blocks - .github/workflows/nightly-benchmark.yml: remove HF_TOKEN from 3 env blocks Signed-off-by: Simo Lin <linsimo.mark@gmail.com>

gemini-code-assist · 2026-03-17T06:52:28Z

Note

Gemini is unable to generate a summary for this pull request due to the file types involved not being currently supported.

coderabbitai · 2026-03-17T06:52:49Z

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro

Run ID: a556d500-c42c-4541-95c7-e9124e65bf71

📥 Commits

Reviewing files that changed from the base of the PR and between 56f31bb and 2b91a48.

📒 Files selected for processing (3)

.github/workflows/e2e-gpu-job.yml
.github/workflows/nightly-benchmark.yml
.github/workflows/pr-test-rust.yml

💤 Files with no reviewable changes (3)

.github/workflows/nightly-benchmark.yml
.github/workflows/e2e-gpu-job.yml
.github/workflows/pr-test-rust.yml

📝 Walkthrough

Walkthrough

Environment variables containing API keys and tokens (HF_TOKEN, OPENAI_API_KEY, XAI_API_KEY, ANTHROPIC_API_KEY) are removed from multiple GitHub Actions workflow files across E2E test and benchmark job steps.

Changes

Cohort / File(s)	Summary
E2E Test Workflows `.github/workflows/e2e-gpu-job.yml`, `.github/workflows/pr-test-rust.yml`	Removed HF_TOKEN, OPENAI_API_KEY, XAI_API_KEY, and ANTHROPIC_API_KEY environment variables from E2E test job steps.
Benchmark Workflows `.github/workflows/nightly-benchmark.yml`, `.github/workflows/pr-test-rust.yml`	Removed HF_TOKEN environment variable from benchmark and Go OAI server test job steps.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~5 minutes

Possibly related PRs

#550 — Modifies CI workflow files to adjust how e2e jobs handle secrets and Dependabot gating
#411 — Changes job environment variables in nightly-benchmark.yml workflow
#633 — Manages credentials and environment variable mapping in E2E workflows

Suggested labels

ci, tests

Suggested reviewers

CatherineSue
key4ng

Poem

🐰 A rabbit hops through workflows clean,
Removing secrets from the scene,
No tokens passed through morning air,
Just tests that run with utmost care! ✨

🚥 Pre-merge checks | ✅ 3

✅ Passed checks (3 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately summarizes the main change: removing GitHub secrets from workflow files and relying on Kubernetes pod environment variables for API keys instead.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch slin/remove-secret-env-overrides

📝 Coding Plan

Generate coding plan for human review comments

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 2b91a48dc9

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

chatgpt-codex-connector · 2026-03-17T06:57:44Z

      - name: Run E2E tests
        env:
-          OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
-          XAI_API_KEY: ${{ secrets.XAI_API_KEY }}
-          ANTHROPIC_API_KEY: ${{ secrets.CLAUDE_API_KEY }}
          BRAVE_MCP_HOST: ${{ matrix.setup_agentic_deps && 'brave-search-mcp' || '' }}


Keep vendor API keys wired for e2e-vendor jobs

This step now relies entirely on runner-level API key environment variables, but in the checked-in ARC runner configs (scripts/k8s-runner-resources/runner-values-*.yaml) the runner container env only defines Docker-related vars and does not inject OPENAI_API_KEY, XAI_API_KEY, or ANTHROPIC_API_KEY. The vendor test fixture fails hard when those vars are absent (e2e_test/fixtures/setup_backend.py checks api_key_env and calls pytest.fail), so deployments that follow the repo’s runner manifests will fail these jobs after this change unless a fallback (for example GitHub secrets) is kept or the runner env injection is added in-repo.

Useful? React with 👍 / 👎.

…mg-project#782) Signed-off-by: Simo Lin <linsimo.mark@gmail.com>

slin1237 requested review from CatherineSue, XinyueZhang369 and key4ng as code owners March 17, 2026 06:52

github-actions Bot added the ci CI/CD configuration changes label Mar 17, 2026

coderabbitai Bot approved these changes Mar 17, 2026

View reviewed changes

chatgpt-codex-connector Bot reviewed Mar 17, 2026

View reviewed changes

slin1237 merged commit 3282dc1 into main Mar 17, 2026
59 of 61 checks passed

slin1237 deleted the slin/remove-secret-env-overrides branch March 17, 2026 07:44

coderabbitai Bot mentioned this pull request Mar 19, 2026

fix(ci): fix model caching and PVC permissions for k8s GPU runners #829

Closed

2 of 6 tasks

smfirmin pushed a commit to smfirmin/smg that referenced this pull request Mar 20, 2026

fix(ci): use k8s pod env vars for API keys instead of GitHub secrets (s…

f4abe89

…mg-project#782) Signed-off-by: Simo Lin <linsimo.mark@gmail.com>

smfirmin pushed a commit to smfirmin/smg that referenced this pull request Mar 20, 2026

fix(ci): use k8s pod env vars for API keys instead of GitHub secrets (s…

1b785cb

…mg-project#782) Signed-off-by: Simo Lin <linsimo.mark@gmail.com>

coderabbitai Bot mentioned this pull request Mar 31, 2026

ci(review): add Claude Code PR review workflow #984

Closed

4 tasks

Navigation Menu

Repository navigation

fix(ci): use k8s pod env vars for API keys instead of GitHub secrets - #782

fix(ci): use k8s pod env vars for API keys instead of GitHub secrets#782
slin1237 merged 1 commit into
mainfrom
slin/remove-secret-env-overrides

slin1237 commented Mar 17, 2026 •

edited by coderabbitai Bot

Loading

Uh oh!

gemini-code-assist Bot commented Mar 17, 2026

Uh oh!

coderabbitai Bot commented Mar 17, 2026 •

edited

Loading

Walkthrough

Changes

Estimated code review effort

Possibly related PRs

Suggested labels

Suggested reviewers

Poem

Uh oh!

chatgpt-codex-connector Bot left a comment

Uh oh!

chatgpt-codex-connector Bot Mar 17, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

slin1237 commented Mar 17, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Problem

What changed

Test plan

Summary by CodeRabbit

Uh oh!

gemini-code-assist Bot commented Mar 17, 2026

Uh oh!

coderabbitai Bot commented Mar 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

Estimated code review effort

Possibly related PRs

Suggested labels

Suggested reviewers

Poem

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

chatgpt-codex-connector Bot Mar 17, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

slin1237 commented Mar 17, 2026 •

edited by coderabbitai Bot

Loading

coderabbitai Bot commented Mar 17, 2026 •

edited

Loading