From a3676f1844da888b3abb034443b1f91cf88aed33 Mon Sep 17 00:00:00 2001
From: Chris Hagglund <chris.hagglund@orkes.io>
Date: Wed, 9 Sep 2026 09:30:52 -0600
Subject: [PATCH] set default for var that won't exist on forked repo PRs, and
 skip agent e2e from forked repos since it will not have the secrets either

---
 .github/workflows/agent-e2e.yml    |  4 ++++
 .github/workflows/pull_request.yml | 18 +++++++++---------
 2 files changed, 13 insertions(+), 9 deletions(-)

diff --git a/.github/workflows/agent-e2e.yml b/.github/workflows/agent-e2e.yml
index 2d0328b..efbadfe 100644
--- a/.github/workflows/agent-e2e.yml
+++ b/.github/workflows/agent-e2e.yml
@@ -20,6 +20,10 @@ env:
 
 jobs:
   agent-e2e:
+    # Fork PRs get no secrets, so every suite here would run against a server
+    # with no LLM key and burn the full 45-minute timeout before the guard
+    # below failed it. Skip outright instead.
+    if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }}
     runs-on: ubuntu-latest
     timeout-minutes: 45
     env:
diff --git a/.github/workflows/pull_request.yml b/.github/workflows/pull_request.yml
index 07f765c..14cb31d 100644
--- a/.github/workflows/pull_request.yml
+++ b/.github/workflows/pull_request.yml
@@ -14,7 +14,7 @@ on:
   workflow_dispatch:
     inputs:
       oss_conductor_version:
-        description: 'OSS Conductor image tag (falls back to E2E_TEST_OSS_CONDUCTOR_VERSION org var)'
+        description: 'OSS Conductor image tag (falls back to E2E_TEST_OSS_CONDUCTOR_VERSION org var, then to a pinned default)'
         required: false
         type: string
 
@@ -173,15 +173,15 @@ jobs:
     runs-on: ubuntu-latest
     env:
       CONDUCTOR_SERVER_URL: http://localhost:8080/api
-      OSS_CONDUCTOR_VERSION: ${{ inputs.oss_conductor_version || vars.E2E_TEST_OSS_CONDUCTOR_VERSION }}
+      # The literal fallback is not redundant: GitHub withholds org/repo
+      # variables from pull_request runs on forks exactly as it withholds
+      # secrets, so vars.* resolves to "" there. This job needs no secrets —
+      # only a tag — so it pins one and keeps running on fork PRs instead of
+      # failing with nothing to pull.
+      OSS_CONDUCTOR_VERSION: ${{ inputs.oss_conductor_version || vars.E2E_TEST_OSS_CONDUCTOR_VERSION || '3.32.3' }}
     steps:
-      - name: Verify OSS Conductor version is set
-        run: |
-          if [ -z "$OSS_CONDUCTOR_VERSION" ]; then
-            echo "::error::No Conductor OSS image tag resolved. Set the E2E_TEST_OSS_CONDUCTOR_VERSION organization variable (and ensure its repository access policy includes this repo), or pass the oss_conductor_version input via workflow_dispatch."
-            exit 1
-          fi
-          echo "Using conductoross/conductor:$OSS_CONDUCTOR_VERSION"
+      - name: Show OSS Conductor version
+        run: echo "Using conductoross/conductor:$OSS_CONDUCTOR_VERSION"
       - name: Checkout
         uses: actions/checkout@v4
       - name: Write docker-compose file