Field notes
GitHub Actions fix guides
The worst CI problems are not the ones that fail. They are the ones that carry on: a secret that resolves to an empty string instead of erroring, a rate limit reported as a cache miss, a job that goes green having skipped the deploy. Each note takes one of those, explains why it is silent, and gives you a script that finds it through the API.
Every problem here degrades gracefully by design, which is correct behaviour and exactly what hides it. A missing cache should not break a build; an untrusted pull request should not receive your credentials. The cost is that the log line for the safe outcome and the log line for the broken one are the same, so you have to ask the API instead.
GitHub Actions
Secrets are empty strings in fork pull requests
A workflow that works on main fails on an outside contributor's PR. Secrets are not withheld with an error — they resolve to empty strings.
GITHUB_TOKEN is read-only and the error just says 403
A workflow that pushes a commit or creates a release fails with 403 Resource not accessible by integration. The token defaults to read-only.
Three pushes run three full pipelines and you pay for all of them
Push three commits to a PR in a minute and GitHub runs the whole pipeline three times. Only the last result matters, and macOS bills at ten times the rate.
A cache miss that is really a rate limit
Builds get slower with no error. When the cache API rate limits a repository it is reported as a cache miss, so the job restores nothing and carries on.
These are the ones I keep hitting. If yours is broken in a way none of them describes, tell me on LinkedIn — it is usually how the next note gets written.