🩹 ci: Fix Invalid Workflow Blocking Package Publishing

.github/workflows/validate.yml

@@ -118,10 +118,8 @@ jobs:
           NODE_OPTIONS: '--experimental-vm-modules'
           NODE_ENV: test
           OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
-          OPENAI_BASE_URL: ${{ secrets.OPENAI_BASE_URL }}
           OPENAI_BASE_URL: ${{ vars.OPENAI_BASE_URL || secrets.OPENAI_BASE_URL }}
           ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
-          ANTHROPIC_BASE_URL: ${{ secrets.ANTHROPIC_BASE_URL }}
           ANTHROPIC_BASE_URL: ${{ vars.ANTHROPIC_BASE_URL || secrets.ANTHROPIC_BASE_URL }}
           GOOGLE_API_KEY: ${{ secrets.GOOGLE_API_KEY }}
           AZURE_MODEL_NAME: ${{ secrets.AZURE_MODEL_NAME }}
@@ -168,10 +166,8 @@ jobs:
           NODE_OPTIONS: '--experimental-vm-modules'
           NODE_ENV: test
           OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
-          OPENAI_BASE_URL: ${{ secrets.OPENAI_BASE_URL }}
           OPENAI_BASE_URL: ${{ vars.OPENAI_BASE_URL || secrets.OPENAI_BASE_URL }}
           ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
-          ANTHROPIC_BASE_URL: ${{ secrets.ANTHROPIC_BASE_URL }}
           ANTHROPIC_BASE_URL: ${{ vars.ANTHROPIC_BASE_URL || secrets.ANTHROPIC_BASE_URL }}
           GOOGLE_API_KEY: ${{ secrets.GOOGLE_API_KEY }}
           AZURE_MODEL_NAME: ${{ secrets.AZURE_MODEL_NAME }}
@@ -274,7 +270,6 @@ jobs:
           NODE_OPTIONS: '--experimental-vm-modules'
           NODE_ENV: test
           ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
-          ANTHROPIC_BASE_URL: ${{ secrets.ANTHROPIC_BASE_URL }}
           ANTHROPIC_BASE_URL: ${{ vars.ANTHROPIC_BASE_URL || secrets.ANTHROPIC_BASE_URL }}
 
       - name: Surface Anthropic LLM soft failure

.github/workflows/workflow-syntax.yml

@@ -0,0 +1,34 @@
+name: Workflow Syntax
+
+on:
+  pull_request:
+    branches:
+      - dev
+      - main
+    paths:
+      - '.github/workflows/**'
+      - 'config/workflow-syntax.test.mjs'
+  push:
+    branches:
+      - main
+    paths:
+      - '.github/workflows/**'
+      - 'config/workflow-syntax.test.mjs'
+
+permissions:
+  contents: read
+
+jobs:
+  syntax:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: '24.x'
+          cache: npm
+
+      - run: npm ci --ignore-scripts --no-audit --no-fund
+
+      - run: node --test config/workflow-syntax.test.mjs

config/workflow-syntax.test.mjs

@@ -0,0 +1,35 @@
+import path from 'node:path';
+import assert from 'node:assert/strict';
+import test from 'node:test';
+import { readdir, readFile } from 'node:fs/promises';
+import { fileURLToPath } from 'node:url';
+import { format } from 'prettier';
+
+const workflowsDirectory = fileURLToPath(
+  new URL('../.github/workflows/', import.meta.url)
+);
+
+test('workflow files have valid YAML and unique mapping keys', async () => {
+  const files = (await readdir(workflowsDirectory)).filter((file) =>
+    /\.ya?ml$/.test(file)
+  );
+
+  await Promise.all(
+    files.map(async (file) => {
+      const source = await readFile(
+        path.join(workflowsDirectory, file),
+        'utf8'
+      );
+      await assert.doesNotReject(format(source, { parser: 'yaml' }), file);
+    })
+  );
+});
+
+test('duplicate environment keys invalidate a workflow', async () => {
+  await assert.rejects(
+    format('env:\n  OPENAI_BASE_URL: first\n  OPENAI_BASE_URL: second\n', {
+      parser: 'yaml',
+    }),
+    /Map keys must be unique/
+  );
+});