python profile: main.yml is invalid (secrets context in a step-level if), so all CI fails at 0s

[simontaurus]

Every repository generated from the python profile has a main.yml that GitHub rejects, so all jobs fail immediately on the first push or pull request.

Cause

profiles/python/.github/workflows/main.yml uses the secrets context in a step-level if: (lines 164 and 168):

      - name: Track benchmarks with Bencher
        if: ${{ secrets.BENCHER_API_TOKEN != '' }}
        uses: bencherdev/bencher@main

      - name: Upload results to Bencher
        if: ${{ secrets.BENCHER_API_TOKEN != '' }}

The secrets context is not available in if: conditions. The file is therefore invalid, and the failure is not scoped to the benchmark job: the whole workflow is rejected before any job starts.

Observed

On OO-LD/awl-python immediately after applying the profile, run 32350132267 completed in 0s with:

This run likely failed because of a workflow file issue.

Changing only those two conditions made the workflow parse, and run 32350638101 is green across the full matrix.

Suggested fix

Promote the secret to a job-level env and gate on that, which is the pattern the profile already uses in on-release-main.yml and template-update.yml:

    env:
      BENCHER_PROJECT: {{ project_name }}
      BENCHER_API_TOKEN: ${{ secrets.BENCHER_API_TOKEN }}
    steps:
      ...
      - name: Track benchmarks with Bencher
        if: env.BENCHER_API_TOKEN != ''
        uses: bencherdev/bencher@main

and reference "$BENCHER_API_TOKEN" in the bencher run invocation instead of ${{ secrets.BENCHER_API_TOKEN }}.

Note

The template repository's own CI is unaffected because it runs its own root .github/workflows/main.yml, not the profile overlay, which is likely why this has gone unnoticed.