[piyushmakhija28]

The shipped workflow-config.json carries "github": {"token": "YOUR_GITHUB_TOKEN"}. load_workflow_config injected that literal string into GITHUB_TOKEN, and one placeholder defeated both GitHub backends at once:

• the MCP client authenticated with it → 401 Bad credentials
• the gh CLI fallback also lost, because gh prefers an environment token over its own keyring and reported itself unauthenticated

So gh auth login appeared to do nothing. The machine was correctly authenticated — gh auth status said so, a standalone GitHubOperationRouter said so — and the pipeline still fell back to no GitHub backend available on every run, creating neither an issue nor a branch.

The engine's whole SDLC arc was blocked by a string nobody filled in.

The scope is wider than GitHub

This only became visible once the skip was announced. The same config was injecting ten placeholder values:

anthropic.api_key, figma.access_token, figma.team_id, github.token,
jenkins.api_token, jenkins.url, jenkins.user, jira.api_token, jira.url, jira.user

Anyone enabling any of those integrations meets the same failure — and the ones taking a URL rather than a secret would fail even less legibly.

The predicate is deliberately narrow

A false positive rejects a working secret and breaks a setup that was fine — worse than the bug it guards against. So nothing is matched on length, entropy or character class, only on shapes no real credential has: a YOUR_/your- prefix, angle brackets, CHANGEME, REPLACE_ME, TODO, xxx, or empty.

Half the tests exist to hold it there. ghp_…, gho_…, github_pat_… pass, and so does yourcompany-prod-key — which starts with "your" but is not a template.

The skip is announced on stderr: a value silently ignored is indistinguishable from one never read, and the reader is someone wondering why their config has no effect — exactly the position this bug put its author in.

Proven against the real broken config, not a fixture

The placeholder was restored to ~/.claude/workflow-config.json to reproduce the original state. With it present:

[config_loader] ignored 10 unfilled placeholder value(s): …
[MCP] Token acquired from gh CLI keyring
[MCP] PyGithub authenticated as: piyushmakhija28
GITHUB_TOKEN injected : False
MCP backend  : OK
gh CLI backend: OK

The file is left in that shipped state, since it is now handled correctly and the notice tells the user which integrations are unconfigured.

A test-harness note worth recording

_load_raw memoises into _CONFIG_CACHE on first read, after which the path argument is silently ignored. The first draft of these tests did not reset it, so three of them asserted against the developer's own ~/.claude/workflow-config.json instead of their fixtures — a green suite proving nothing. The autouse fixture resets it, and the docstring says why.

Context

This came out of the first successful end-to-end run of the pipeline: issue #306 and branch feature/issue-306 were minted for real once the placeholder was removed by hand. This PR makes that removal unnecessary.

🤖 Generated with Claude Code