ignore-if-missing generates invalid if: expression using secrets context

[MrSanchez]

Hi,

I ran into this issue while setting up gh-aw in my organization, perhaps I am misunderstanding but:

When ignore-if-missing: true is set on safe-outputs.github-app, the compiler seems to generate an if: condition that references secrets:

if: ${{ vars.MYAPP_CLIENT_ID != '' && secrets.MYAPP_PRIVATE_KEY != '' }}

GitHub Actions rejects this at parse time: secrets is not a valid context in if: expressions (only github, needs, vars, env, inputs, steps are allowed).

Error: Unrecognized named-value: 'secrets'. Located at position 31 within expression

Workaround I applied: Remove ignore-if-missing: true. The if: condition is no longer generated and the step runs unconditionally.

Relevant documentation that seems problematic: https://github.github.com/gh-aw/reference/auth/#gracefully-skip-minting-when-keys-are-missing-ignore-if-missing

Versions I experienced this on: gh-aw v0.81.6 and v0.82.7

[Tarekchehahde]

Proposed fix (branch pushed; opening upstream PR may require maintainer permissions):

Branch: fix/44709-ignore-if-missing-secrets-if on https://github.com/Tarekchehahde/gh-aw

Compare: main...Tarekchehahde:gh-aw:fix/44709-ignore-if-missing-secrets-if

Approach: Replace if: \${{ secrets.X != '' }} with a bash probe step that reads credentials from env (secrets allowed there), then gate mint with steps.check-*-credentials.outputs.present == 'true'.

Local tests: go test ./pkg/workflow/... -run 'IgnoreIfMissing|GitHubAppCredentialsProbe|skip_if_match_with_github_app' — pass

[Tarekchehahde]

Fork PR: Tarekchehahde#1

(Compare link in earlier comment remains valid for upstream PR creation.)

[pelikhan]

@MrSanchez please run debug.md to generate an issue as spec.