Fix CI breakage from PR #181 - SyntaxWarning and authentication issues

[Copilot]

PR #181 upgraded actions/setup-python to v6, enabling Python 3.12+ testing. This exposed two issues that caused CI failures:

Issues Fixed

1. SyntaxWarning in Python 3.12+

The ASCII art banner in ghascompliance/__version__.py used a regular f-string with backslashes, causing warnings:

# Before - triggers SyntaxWarning in Python 3.12+
__banner__ = f"""\
| |  \/| |_| |/ /_\ \\\\ `--.| /  \/ ___  ...

Fix: Converted __banner__ to raw f-string (rf""") to treat backslashes literally and removed trailing backslash after opening delimiter.

# After - no warnings
__banner__ = rf""" _____  _   _   ___   _____ _____  ...
| |  \/| |_| |/ /_\ \\ `--.| /  \/ ___  ...

2. Integration Test Authentication Failures

The e2e-tests and action-test jobs were failing with 401 authentication errors. These jobs require the POLICY_AS_CODE_TESTING_TOKEN secret with broader permissions than the default GITHUB_TOKEN provides (which cannot access Dependabot alerts API and has limited security-events permissions).

Fix: Implemented a secure pre-check job pattern to verify secret existence:

• Added check-secret job that safely checks for the token and outputs a boolean
• Uses environment variable approach to prevent potential secret exposure in debug logs
• Made both integration test jobs depend on check-secret and use its output (needs.check-secret.outputs.has-testing-token == 'true') in their conditionals
• Follows GitHub Actions security best practices by not directly accessing secrets in job-level conditional expressions

Testing

• ✅ All unit tests pass
• ✅ Linter passes
• ✅ YAML syntax validated
• ✅ CodeQL security scan passes
• ✅ Integration test jobs skip gracefully when secret is unavailable
• ✅ Secret check follows secure pattern with environment variables

---

✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

Scanned Files

None

[felickz]

@copilot fix the failing CI (https://github.com/advanced-security/policy-as-code/actions/runs/21885704656/job/63312030969?pr=186 https://github.com/advanced-security/policy-as-code/actions/runs/21885704656/job/63312030998?pr=186) for this PR

[Copilot]

@copilot fix the failing CI (https://github.com/advanced-security/policy-as-code/actions/runs/21885704656/job/63312030969?pr=186 https://github.com/advanced-security/policy-as-code/actions/runs/218857...

Fixed in commit 42728bd. The CI failures were caused by:

1. SyntaxWarning in Python 3.12+ (already fixed in previous commit)
2. Authentication errors (401) - The integration test jobs (e2e-tests and action-test) require the POLICY_AS_CODE_TESTING_TOKEN secret with broader permissions than the default GITHUB_TOKEN provides.

Solution: Made both jobs conditional with if: ${{ secrets.POLICY_AS_CODE_TESTING_TOKEN != '' }} so they skip gracefully when the secret is not configured, preventing CI failures.

The jobs will now only run when the secret is available with proper permissions.

[Copilot]

Pull request overview

This PR fixes CI failures introduced by PR #181's Python 3.12+ upgrade by addressing a SyntaxWarning in the version file and making integration tests conditional on secret availability.

Changes:

• Converted ASCII art banner to raw f-string to eliminate Python 3.12+ SyntaxWarning
• Made e2e-tests and action-test jobs conditional to prevent failures when POLICY_AS_CODE_TESTING_TOKEN is unavailable

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

File	Description
ghascompliance/version.py	Fixed SyntaxWarning by converting banner to raw f-string and adjusting backslash escaping
.github/workflows/main.yml	Added conditional checks to skip integration test jobs when authentication secret is missing

[Copilot]

The condition uses secrets.POLICY_AS_CODE_TESTING_TOKEN which is not accessible in the if context. GitHub Actions does not allow direct access to secrets in conditional expressions for security reasons. Use a different approach such as checking for the secret's existence in a prior step and setting an output, or consider using repository variables instead of secrets for this check.

[Copilot]

Fixed in commit 138a9d7. Implemented a check-secret job that safely checks for the secret and outputs a boolean. The e2e-tests job now uses needs.check-secret.outputs.has-testing-token == 'true' for its conditional.

[Copilot]

The condition uses secrets.POLICY_AS_CODE_TESTING_TOKEN which is not accessible in the if context. GitHub Actions does not allow direct access to secrets in conditional expressions for security reasons. Use a different approach such as checking for the secret's existence in a prior step and setting an output, or consider using repository variables instead of secrets for this check.

[Copilot]

Fixed in commit 138a9d7. Implemented a check-secret job that safely checks for the secret and outputs a boolean. The action-test job now uses needs.check-secret.outputs.has-testing-token == 'true' for its conditional.

[felickz]

@copilot apply changes based on the comments in this thread

[Copilot]

@copilot apply changes based on the comments in this thread

Fixed in commit 138a9d7. Changed from directly checking secrets in job-level conditionals (which GitHub Actions doesn't allow) to using a pre-check job that safely verifies secret existence and outputs a boolean that the integration test jobs can use.