ci(bot): sync env-flag phantom-run fix from main @ 9dd05d3

Content snapshot (not cherry-pick): ACCOUNT_TOKEN_SET job-env derivation
replacing secrets.* in step ifs (push-path parse rejection,
actions/runner#4001 class) + concurrency run_id fallbacks. Identical
trees to main for these files; merges stay no-ops.

Author: Mirrowel

.github/workflows/bot-reply.yml

@@ -24,7 +24,7 @@ on:
 # superseded mention's content is still in the thread history and the next
 # run on that thread sees it.
 concurrency:
-  group: bot-reply-${{ inputs.threadNumber }}
+  group: bot-reply-${{ inputs.threadNumber || github.run_id }}
   cancel-in-progress: false
 
 jobs:
@@ -52,6 +52,15 @@ jobs:
       # dedicated context block (same machinery as PR Review). Default 1.
       PREVIOUS_BOT_REVIEWS_COUNT: ${{ vars.PREVIOUS_BOT_REVIEWS_COUNT || '1' }}
 
+      # secrets.* is not evaluable in step-level if: conditionals - the
+      # push-path validation of dispatch-only workflows (actions/runner#4001
+      # phantom runs) rejects the file with "Unrecognized named-value:
+      # (secrets)". Deriving the boolean here (job env, where secrets IS
+      # valid) and branching on env.X in step ifs is the sanctioned pattern.
+      # NOTE: a later step writing ACCOUNT_TOKEN_SET to $GITHUB_ENV would
+      # override this - do not do that.
+      ACCOUNT_TOKEN_SET: ${{ secrets.ACCOUNT_GH_TOKEN != '' }}
+
     steps:
       # Sparse default-branch checkout for the SHARED routing script, so the
       # re-validation below runs the exact same decision logic as the router
@@ -157,7 +166,7 @@ jobs:
         # validate gate passed (mention confirmed in actual content). The
         # regular react step below is the app-mode fallback.
         id: fast_eyes
-        if: steps.validate.outputs.should_proceed == 'true' && inputs.commentId != '' && secrets.ACCOUNT_GH_TOKEN != ''
+        if: steps.validate.outputs.should_proceed == 'true' && inputs.commentId != '' && env.ACCOUNT_TOKEN_SET == 'true'
         continue-on-error: true
         env:
           GH_TOKEN: ${{ secrets.ACCOUNT_GH_TOKEN }}

.github/workflows/compliance-check.yml

@@ -32,7 +32,7 @@ name: Compliance Check
 
 # Prevent concurrent runs for the same PR
 concurrency:
-  group: ${{ github.workflow }}-${{ inputs.pr_number }}
+  group: ${{ github.workflow }}-${{ inputs.pr_number || github.run_id }}
   cancel-in-progress: false
 
 on:
@@ -146,13 +146,22 @@ jobs:
           }
         ]
 
+      # secrets.* is not evaluable in step-level if: conditionals - the
+      # push-path validation of dispatch-only workflows (actions/runner#4001
+      # phantom runs) rejects the file with "Unrecognized named-value:
+      # (secrets)". Deriving the boolean here (job env, where secrets IS
+      # valid) and branching on env.X in step ifs is the sanctioned pattern.
+      # NOTE: a later step writing ACCOUNT_TOKEN_SET to $GITHUB_ENV would
+      # override this - do not do that.
+      ACCOUNT_TOKEN_SET: ${{ secrets.ACCOUNT_GH_TOKEN != '' }}
+
     steps:
       # ========================================================================
       # FAST EYES (account mode, routed comments only) - see pr-review.yml
       # ========================================================================
       - name: Fast eyes on trigger (account mode)
         id: fast_eyes
-        if: github.event_name == 'workflow_dispatch' && inputs.commentId != '' && secrets.ACCOUNT_GH_TOKEN != ''
+        if: github.event_name == 'workflow_dispatch' && inputs.commentId != '' && env.ACCOUNT_TOKEN_SET == 'true'
         continue-on-error: true
         env:
           GH_TOKEN: ${{ secrets.ACCOUNT_GH_TOKEN }}

.github/workflows/pr-review.yml

@@ -74,6 +74,15 @@ jobs:
       REVIEW_THREAD_FETCH_LIMIT: '40'
       THREAD_COMMENT_FETCH_LIMIT: '10'
 
+      # secrets.* is not evaluable in step-level if: conditionals - the
+      # push-path validation of dispatch-only workflows (actions/runner#4001
+      # phantom runs) rejects the file with "Unrecognized named-value:
+      # (secrets)". Deriving the boolean here (job env, where secrets IS
+      # valid) and branching on env.X in step ifs is the sanctioned pattern.
+      # NOTE: a later step writing ACCOUNT_TOKEN_SET to $GITHUB_ENV would
+      # override this - do not do that.
+      ACCOUNT_TOKEN_SET: ${{ secrets.ACCOUNT_GH_TOKEN != '' }}
+
     steps:
       # ========================================================================
       # FAST EYES (account mode, routed comments only)
@@ -86,7 +95,7 @@ jobs:
       # Failure never blocks the run (cosmetic signal, continue-on-error).
       - name: Fast eyes on trigger (account mode)
         id: fast_eyes
-        if: github.event_name == 'workflow_dispatch' && inputs.commentId != '' && secrets.ACCOUNT_GH_TOKEN != ''
+        if: github.event_name == 'workflow_dispatch' && inputs.commentId != '' && env.ACCOUNT_TOKEN_SET == 'true'
         continue-on-error: true
         env:
           GH_TOKEN: ${{ secrets.ACCOUNT_GH_TOKEN }}