From 4d29d0266850fccf90a47b65365f6ef06df2030e Mon Sep 17 00:00:00 2001
From: Kevin Miao <kevin.miao@fingerprint.com>
Date: Tue, 7 Jul 2026 14:57:39 -0700
Subject: [PATCH] fix(create-pr,release-typescript-project): move secrets check
 into run block

---
 .github/workflows/create-pr.yml               | 20 +++++++++++++------
 .../workflows/release-typescript-project.yml  | 10 +++++++---
 2 files changed, 21 insertions(+), 9 deletions(-)

diff --git a/.github/workflows/create-pr.yml b/.github/workflows/create-pr.yml
index 9e22789..d7e4919 100644
--- a/.github/workflows/create-pr.yml
+++ b/.github/workflows/create-pr.yml
@@ -41,10 +41,14 @@ jobs:
           persist-credentials: false
 
       - name: 'Validate app credentials'
-        if: ${{ (inputs.client-id != '' || inputs.app_id != '') && secrets.APP_PRIVATE_KEY == '' }}
+        if: ${{ inputs.client-id != '' || inputs.app_id != '' }}
+        env:
+          APP_PRIVATE_KEY: ${{ secrets.APP_PRIVATE_KEY }}
         run: |
-          echo "Error: APP_PRIVATE_KEY secret must be provided when client-id or app_id is set"
-          exit 1
+          if [ -z "$APP_PRIVATE_KEY" ]; then
+            echo "Error: APP_PRIVATE_KEY secret must be provided when client-id or app_id is set"
+            exit 1
+          fi
 
       - name: 'Get token for the GitHub App'
         if: ${{ inputs.client-id != '' || inputs.app_id != '' }}
@@ -71,10 +75,14 @@ jobs:
           persist-credentials: false
 
       - name: 'Validate app credentials'
-        if: ${{ (inputs.client-id != '' || inputs.app_id != '') && secrets.APP_PRIVATE_KEY == '' }}
+        if: ${{ inputs.client-id != '' || inputs.app_id != '' }}
+        env:
+          APP_PRIVATE_KEY: ${{ secrets.APP_PRIVATE_KEY }}
         run: |
-          echo "Error: APP_PRIVATE_KEY secret must be provided when client-id or app_id is set"
-          exit 1
+          if [ -z "$APP_PRIVATE_KEY" ]; then
+            echo "Error: APP_PRIVATE_KEY secret must be provided when client-id or app_id is set"
+            exit 1
+          fi
 
       - name: 'Get token for the GitHub App'
         if: ${{ inputs.client-id != '' || inputs.app_id != '' }}
diff --git a/.github/workflows/release-typescript-project.yml b/.github/workflows/release-typescript-project.yml
index f2a755c..7ae2454 100644
--- a/.github/workflows/release-typescript-project.yml
+++ b/.github/workflows/release-typescript-project.yml
@@ -118,10 +118,14 @@ jobs:
         if: ${{ inputs.runAfterInstall != '' }}
 
       - name: 'Validate app credentials'
-        if: ${{ (inputs.client-id != '' || inputs.appId != '') && secrets.APP_PRIVATE_KEY == '' }}
+        if: ${{ inputs.client-id != '' || inputs.appId != '' }}
+        env:
+          APP_PRIVATE_KEY: ${{ secrets.APP_PRIVATE_KEY }}
         run: |
-          echo "Error: APP_PRIVATE_KEY secret must be provided when client-id or appId is set"
-          exit 1
+          if [ -z "$APP_PRIVATE_KEY" ]; then
+            echo "Error: APP_PRIVATE_KEY secret must be provided when client-id or appId is set"
+            exit 1
+          fi
 
       - name: 'Get token for the GitHub App'
         if: ${{ inputs.client-id != '' || inputs.appId != '' }}