fix: correct GitHub Actions secrets context usage in if conditions

- secrets context is not allowed in job/step-level if conditions;
  move checks into shell (exit 0 if secret unset)
- Fixes YAML/semantic error causing 0s workflow file issue failures

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

.github/workflows/ci.yml

@@ -286,10 +286,13 @@ jobs:
           echo "arm64=${ARM64}" >> $GITHUB_OUTPUT
           echo "x86_64=${X86}"  >> $GITHUB_OUTPUT
       - name: Update Homebrew tap
-        if: ${{ secrets.HOMEBREW_TAP_TOKEN != '' }}
         env:
           HOMEBREW_TAP_TOKEN: ${{ secrets.HOMEBREW_TAP_TOKEN }}
         run: |
+          if [ -z "${HOMEBREW_TAP_TOKEN}" ]; then
+            echo "HOMEBREW_TAP_TOKEN not set, skipping Homebrew tap update"
+            exit 0
+          fi
           VERSION="${{ steps.tarballs.outputs.version }}"
           ARM64_SHA="${{ steps.sha.outputs.arm64 }}"
           X86_SHA="${{ steps.sha.outputs.x86_64 }}"

.github/workflows/nightly.yml

@@ -11,7 +11,6 @@ env:
 jobs:
   live-openai:
     runs-on: ubuntu-latest
-    if: secrets.OPENAI_API_KEY != ''
     steps:
       - uses: actions/checkout@v4
       - uses: dtolnay/rust-toolchain@stable
@@ -19,11 +18,15 @@ jobs:
       - name: Run live OpenAI integration tests
         env:
           OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
-        run: cargo test --test live_api -- --ignored --test-threads=1
+        run: |
+          if [ -z "${OPENAI_API_KEY}" ]; then
+            echo "OPENAI_API_KEY not set, skipping live tests"
+            exit 0
+          fi
+          cargo test --test live_api -- --ignored --test-threads=1
 
   live-bedrock:
     runs-on: ubuntu-latest
-    if: secrets.AWS_ACCESS_KEY_ID != ''
     steps:
       - uses: actions/checkout@v4
       - uses: dtolnay/rust-toolchain@stable
@@ -33,4 +36,9 @@ jobs:
           AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
           AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
           AWS_REGION: ${{ vars.AWS_REGION || 'us-east-1' }}
-        run: cargo test --test live_bedrock -- --ignored --test-threads=1
+        run: |
+          if [ -z "${AWS_ACCESS_KEY_ID}" ]; then
+            echo "AWS_ACCESS_KEY_ID not set, skipping live tests"
+            exit 0
+          fi
+          cargo test --test live_bedrock -- --ignored --test-threads=1