ci(deploy): fail fast when FLY_API_TOKEN is absent

[abrichr]

The failure

Deploy Worker has never succeeded. All 9 runs, 2026-03-02 → 2026-03-19, failed at the same step:

JOB: CI / Lint, Test & Build   [success]
JOB: Deploy to Fly.io          [failure]
  success  Setup Fly CLI
  failure  Deploy worker        ← flyctl deploy

The cause is that FLY_API_TOKEN does not exist:

Scope	Secrets present
Repository	(none)
Organization (visible to this repo)	ADMIN_TOKEN, DOCS_DISPATCH_TOKEN
production environment	(none)

flyctl has been handed an empty token on every run. Meanwhile wright-worker.fly.dev answers HTTP 200 — the worker is real and deployed, just by hand.

What this PR does and does not do

It does not fix the deploy. Nothing in the repository can mint a Fly token. It fixes the cost and the diagnosis.

Today the workflow runs the full ci reusable workflow first — duplicating the CI run that ci.yml already performs on the same push — and only then fails on the last line, with an error naming flyctl rather than the missing secret. A preflight job now checks for the credential before anything expensive runs, and both ci and deploy depend on it. A missing token costs seconds instead of a duplicated build matrix, and the run states the exact fix in the job summary and as an annotation.

The preflight declares the same environment: production as the deploy job — otherwise an environment-scoped FLY_API_TOKEN would be invisible to it and the gate would keep failing after the secret was added. That environment has no protection rules, so this adds no approval step.

Why it fails instead of skipping

Skipping would make the run green and bin/oa-green would call this repository healthy. It is not: the deploy path is not wired, and the worker is deployed manually. A green run would report a capability that does not exist. The red is the accurate signal — it now just says why, in five seconds instead of nine minutes.

To clear it:

fly tokens create deploy --app wright-worker
gh secret set FLY_API_TOKEN --repo OpenAdaptAI/openadapt-wright --env production

This is also registered in NEEDS_YOU.md.

Verification

The preflight script was extracted from the YAML and run both ways: empty token → exit 1 with the annotation and the summary block; non-empty token → exit 0. The YAML parses and the job graph is preflight → ci → deploy.

Follow-up, not in this PR

Once the token exists, a push touching apps/worker/** will again run the identical CI job twice — once from ci.yml on push, once through workflow_call here. Deduplicating that without weakening the green-CI gate on deploys is a separate change.

🤖 Generated with Claude Code

https://claude.ai/code/session_01NyCHrzA1psrKMFfroYbzaM