## Description
PRs from external forks have been failing CI because
`google-github-actions/auth` cannot complete OIDC auth: our GCP Workload
Identity Federation provider only trusts the base repository, so the
OIDC token issued for a fork-PR run (which carries the fork's
`repository` claim) is rejected. See [run
#25071797593](https://github.com/warpdotdev/warp/actions/runs/25071797593/job/73455200680?pr=9280)
for an example failure.
The auth is only needed by SSH integration tests, which use `gcloud
compute start-iap-tunnel` to reach a GCP-hosted Ubuntu VM. As a
short-term unblock, this skips the `auth` and `setup-gcloud` steps on
fork-PR runs and filters the SSH-dependent tests out of the test runs
(they all match `_ssh_` in their test names). All other tests continue
to run as before, and SSH integration coverage is unchanged on `master`,
`workflow_dispatch`, `workflow_call`, and same-repo PRs — those tests
still validate post-merge.
A more complete fix (e.g. a `workflow_run`-triggered job that runs SSH
tests in the base repo's context against the fork's SHA) is a possible
follow-up if we decide fork PRs need full SSH coverage.
## Testing
Validated via YAML parse. Will verify behavior on this PR's CI run
(same-repo PR — SSH tests should still run) and on a fork PR before
relying on it.
## Server API dependencies
N/A — CI-only change.
## Agent Mode
- [x] Warp Agent Mode - This PR was created via Warp's AI Agent Mode
## Description
A couple issues that needed fixing:
* Using `--all-features` and `--all-targets` causes us to try to build
the first-party binaries with embedded configuration, which isn't
available from this repository. To unblock CI, we'll only run clippy on
the default feature set for right now.
* Similarly, testing compilation with release configuration was trying
to build the `dev` channel; this switches that over to the `oss`
channel.
## Description
The local `Review Pull Request` workflow in this repo has been failing
on every `pull_request_target` event with `startup_failure` (no jobs
created) for newly opened PRs. Recent runs that hit this:
- https://github.com/warpdotdev/warp/actions/runs/25059789050
- https://github.com/warpdotdev/warp/actions/runs/25059784082
- https://github.com/warpdotdev/warp/actions/runs/25059568488
### Root cause
`.github/workflows/review-pull-request.yml` declares a `focus` input on
its own `workflow_call` interface and forwards it to the upstream
reusable workflow at
`warpdotdev/oz-for-oss/.github/workflows/review-pull-request.yml@main`.
That upstream workflow's `workflow_call` interface no longer declares
`focus` — it was removed in oz-for-oss commit
[`757b052`](https://github.com/warpdotdev/oz-for-oss/commit/757b052) (PR
#393, "feat(review): allow non-collaborator /oz-review and cap at 3 per
PR"). When the local job tries to forward `focus:` in its `with:` block,
GitHub fails workflow validation before any job is created, which
surfaces as `startup_failure`.
### What this PR changes
Drops every reference to `focus` from the local caller so the contract
matches the upstream `workflow_call` again:
- Removes the `focus` input from `workflow_call.inputs`
- Removes `INPUT_FOCUS` from the `resolve` step's `env`
- Removes the `focus = os.environ.get("INPUT_FOCUS", "")` read and the
heredoc-style `focus<<__EOF__` write to `GITHUB_OUTPUT`
- Removes `focus` from the `resolve` job's `outputs:`
- Removes `focus: ${{ needs.resolve.outputs.focus }}` from the
`review_pr` reusable-workflow `with:`
The forwarded inputs are now `pr_number`, `trigger_source`, `requester`,
and `comment_id`, matching the upstream interface.
### Note on `enforce-pr-issue-state.yml`
While debugging, I confirmed `enforce-pr-issue-state.yml` is
`workflow_call`-only and is not invoked anywhere in this repo (it has
zero historical runs), unlike in `oz-for-oss` where `pr-hooks.yml`
orchestrates enforcement before reviews. That gap is independent of this
fix — `review-pull-request.yml` here listens directly to
`pull_request_target` and does not depend on enforcement output. If we
want enforcement to gate PR reviews on this repo too, that's a follow-up
(either add a `pr-hooks.yml` orchestrator or wire
`enforce-pr-issue-state.yml` to listen to `pull_request_target` directly
and have `review-pull-request.yml` `needs:` it).
## Testing
- `python3 -c "import yaml; yaml.safe_load(...)"` on the modified
workflow to confirm the YAML still parses.
- Diff-checked that the local `with:` block matches the inputs declared
by the upstream `workflow_call` at
`warpdotdev/oz-for-oss/.github/workflows/review-pull-request.yml@main`.
- After this merges, the next `pull_request_target` event on a non-draft
PR should produce a `Review Pull Request` run that actually creates the
`resolve` and `review_pr` jobs instead of failing at startup.
## Server API dependencies
N/A — CI workflow change only.
## Agent Mode
- [x] Warp Agent Mode - This PR was created via Warp's AI Agent Mode
_Conversation:
https://staging.warp.dev/conversation/dd8c9b9a-256b-4c79-abc2-cb513f7236b5_
## Changelog Entries for Stable
Co-authored-by: Oz <oz-agent@warp.dev>
## Description
The reusable workflows under
[`warpdotdev/oz-for-oss`](https://github.com/warpdotdev/oz-for-oss/tree/main/.github/workflows)
declare their Warp API key secret as `OSS_WARP_API_KEY`, but the local
caller workflows in this repo were forwarding it as `WARP_API_KEY`.
Because the name being passed didn't match the name declared by
`workflow_call`, the required secret was effectively missing and an
undeclared secret was being passed instead, which caused
`startup_failure` on every invocation.
Example failure:
https://github.com/warpdotdev/warp/actions/runs/25058665906 (Triage New
Issues (Local), `startup_failure`).
This PR renames the forwarded secret to `OSS_WARP_API_KEY:` in all local
adapter workflows so the names match what the reusable workflows
declare. The underlying secret value is still pulled from
`secrets.OSS_WARP_API_KEY` in this repo, so no repo secret changes are
needed.
Affected workflows:
- `.github/workflows/create-implementation-from-issue-local.yml`
- `.github/workflows/create-spec-from-issue-local.yml`
- `.github/workflows/enforce-pr-issue-state.yml`
- `.github/workflows/respond-to-pr-comment-local.yml`
- `.github/workflows/respond-to-triaged-issue-comment-local.yml`
- `.github/workflows/review-pull-request.yml`
- `.github/workflows/triage-new-issues-local.yml`
- `.github/workflows/trigger-implementation-on-plan-approved-local.yml`
- `.github/workflows/update-dedupe-local.yml`
- `.github/workflows/update-pr-review-local.yml`
- `.github/workflows/update-triage-local.yml`
- `.github/workflows/verify-pr-comment-local.yml`
## Testing
Manual review of the rename. After merge, re-run the failing `Triage New
Issues (Local)` workflow to confirm it no longer hits `startup_failure`
due to a missing required secret.
## Server API dependencies
N/A — CI workflow change only.
## Agent Mode
- [x] Warp Agent Mode - This PR was created via Warp's AI Agent Mode
_Conversation:
https://staging.warp.dev/conversation/fbace74a-9da2-445f-8486-e5a5907dce57_
_Run:
https://oz.staging.warp.dev/runs/019dd47c-42e0-7072-8206-e6be4df5cde7_
_This PR was generated with [Oz](https://warp.dev/oz)._
Co-authored-by: Oz Agent <oz-agent@warp.dev>
David Stern