From 7b366fede5fda051c64c7eb9511c8e7cdbebf6db Mon Sep 17 00:00:00 2001
From: mateo-berri <277851410+mateo-berri@users.noreply.github.com>
Date: Tue, 19 May 2026 08:09:21 +0000
Subject: [PATCH] fix(triage): only pass OPENAI_API_KEY when enabled or
 manually dispatched
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The pull_request_target / issues auto-triggers always passed the LLM API
key, and AGENT_SHIN_ENABLED only gated --close. In dry-run mode the
script still calls the model whenever the key is present, so an
external user could open/reopen PRs or issues with large bodies to drain
LLM credits before the bot was ever enabled.

Bind OPENAI_API_KEY to the empty string unless AGENT_SHIN_ENABLED is
'true' (workflow has opted in to model costs) or the workflow is
running via workflow_dispatch (requires write access — collaborator
only). The script already short-circuits with skip-no-llm-key when the
key is empty, so the pre-enable rollout path for manual QA via 'gh
workflow run' still works for collaborators, but auto-triggered runs
from external authors cannot spend credits.
---
 .github/workflows/triage_issue_with_llm.yml | 10 +++++++++-
 .github/workflows/triage_pr_with_llm.yml    |  9 ++++++++-
 2 files changed, 17 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/triage_issue_with_llm.yml b/.github/workflows/triage_issue_with_llm.yml
index ff0497f9893..f85e9513611 100644
--- a/.github/workflows/triage_issue_with_llm.yml
+++ b/.github/workflows/triage_issue_with_llm.yml
@@ -49,7 +49,15 @@ jobs:
       - name: Run Agent Shin
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
+          # Only expose the LLM key when the workflow is actually allowed to
+          # take action (AGENT_SHIN_ENABLED=true) or when a collaborator runs
+          # it manually via workflow_dispatch (write access required to
+          # trigger). On the public issues path while the bot is not yet
+          # enabled, the key is intentionally absent so the script
+          # short-circuits with skip-no-llm-key — otherwise an external user
+          # could open/reopen issues with large bodies to force paid LLM
+          # calls.
+          OPENAI_API_KEY: ${{ (vars.AGENT_SHIN_ENABLED == 'true' || github.event_name == 'workflow_dispatch') && secrets.OPENAI_API_KEY || '' }}
           OPENAI_BASE_URL: ${{ vars.OPENAI_BASE_URL }}
           TRIAGE_MODEL: ${{ vars.TRIAGE_MODEL }}
           AGENT_SHIN_ENABLED: ${{ vars.AGENT_SHIN_ENABLED }}
diff --git a/.github/workflows/triage_pr_with_llm.yml b/.github/workflows/triage_pr_with_llm.yml
index eac7e6a56b3..fdf2dd35400 100644
--- a/.github/workflows/triage_pr_with_llm.yml
+++ b/.github/workflows/triage_pr_with_llm.yml
@@ -60,7 +60,14 @@ jobs:
       - name: Run Agent Shin
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
+          # Only expose the LLM key when the workflow is actually allowed to
+          # take action (AGENT_SHIN_ENABLED=true) or when a collaborator runs
+          # it manually via workflow_dispatch (write access required to
+          # trigger). On the public pull_request_target path while the bot is
+          # not yet enabled, the key is intentionally absent so the script
+          # short-circuits with skip-no-llm-key — otherwise an external user
+          # could open/reopen PRs with large bodies to force paid LLM calls.
+          OPENAI_API_KEY: ${{ (vars.AGENT_SHIN_ENABLED == 'true' || github.event_name == 'workflow_dispatch') && secrets.OPENAI_API_KEY || '' }}
           OPENAI_BASE_URL: ${{ vars.OPENAI_BASE_URL }}
           TRIAGE_MODEL: ${{ vars.TRIAGE_MODEL }}
           AGENT_SHIN_ENABLED: ${{ vars.AGENT_SHIN_ENABLED }}