CI: Don't fail fork and Dependabot runs on unavailable secrets

[yoavkatz]

Problem

GitHub withholds repository secrets from runs triggered by forks and by Dependabot. Two steps treated those secrets as mandatory and failed hard when they resolved to an empty string.

On #1986 (a Dependabot PR) this produced 11 red jobs that never ran a single test:

Job	Cause
unittests, eager, preparation (0–9)	empty LLMEVALKIT_SSH_KEY
performance	empty UNITXT_READ_HUGGINGFACE_HUB_FOR_TESTS → HTTP 429

1. Internal pip install

.github/actions/install-internal-pip wrote the SSH key to ~/.ssh/id_ed25519 and installed from git+ssh://github.ibm.com. With an empty key:

Load key "/home/runner/.ssh/id_ed25519": error in libcrypto
git@github.ibm.com: Permission denied (publickey).
ERROR: Failed to build 'git+ssh://****@github.ibm.com/MLT/LLMEvalKit.git'

The host is IBM-internal, so it is unreachable from an external fork regardless of the secret.

2. Hugging Face login

An empty token was interpolated into huggingface-cli login --token, retried 5×, and left the run unauthenticated — which then hit the shared-runner rate limit:

urllib.error.HTTPError: HTTP Error 429: Too Many Requests

Change

Skip each step when its secret is absent, with a ::notice:: explaining why. Both guards are no-ops on trusted runs.

• Guard lives inside the step rather than continue-on-error: at the call sites, so a genuine install failure still fails the job when the secret is available.
• Secrets now pass through env: instead of being interpolated into the script body.
• The key is written with printf instead of echo, which mangles values containing backslashes or a leading dash.

Why skipping the install is safe

The llmevalkit imports in src/unitxt/metrics.py are already lazy (inside methods) and declared via _requirements_list. If something actually instantiates those metrics, unitxt raises its normal Install with "pip install ..." error. Everything else is unaffected.

Not fixed here

Unauthenticated runs are still exposed to Hub rate limits — this change reports the cause instead of masking it behind five failed login attempts. Making performance label-triggered or pull_request_target-gated would address that properly, and is left as a follow-up.

Testing

• All .github/**/*.yml parse under yaml.safe_load.
• Guard logic exercised both ways: exits 0 on empty secret, proceeds when set.
• Confirmed multiline PEM keys survive the printf rewrite intact.
• Full verification is the CI run on this PR, plus a rerun of Bump datasets from 2.21.0 to 5.0.1 in /prepare/benchmarks/torr #1986 once this lands.

🤖 Generated with Claude Code