From 6154175a2f0dc0cf9a6dbd66f513a0a6b67974eb Mon Sep 17 00:00:00 2001
From: Ariadne Conill <ariadne@ariadne.space>
Date: Thu, 8 Oct 2026 10:05:42 -0700
Subject: [PATCH] upstream-rebase: take the federation rule from the
 organization too

9bac195b20 moved the organization, service account and workspace to
the organization-wide ANTHROPIC_* variables but left the rule on the
repository's REBASE_FEDERATION_RULE_ID. The nightly run then paired
the organization's service account with that repository rule, and its
first API request was refused. Read ANTHROPIC_FEDERATION_RULE_ID
alongside the others so all four come from the same place.

Also fail the identifier step, naming the variable, when any of the
four is empty or not visible to the repository. Until now an unset
variable surfaced only as the model step failing within a second, with
no reason in the log.
---
 .github/workflows/upstream-rebase.yml | 23 +++++++++++++++++------
 1 file changed, 17 insertions(+), 6 deletions(-)

diff --git a/.github/workflows/upstream-rebase.yml b/.github/workflows/upstream-rebase.yml
index ff0ff62e7e..0098eb1b6f 100644
--- a/.github/workflows/upstream-rebase.yml
+++ b/.github/workflows/upstream-rebase.yml
@@ -33,11 +33,11 @@ name: Nightly upstream rebase
 #       GITHUB_TOKEN cannot do this job: it cannot push commits that touch
 #       .github/workflows/ (every rebase rewrites the ones that add them), and
 #       pull requests it opens do not trigger the review checks.
-#   vars.REBASE_FEDERATION_RULE_ID and friends
-#       Workload identity federation for the Claude API. Each falls back to the
-#       matching PR_REVIEW_* variable. The rule must accept this workflow's
-#       OIDC subject (a scheduled run on edera/4.22), which a rule written for
-#       pull_request events will not.
+#   vars.ANTHROPIC_FEDERATION_RULE_ID, ANTHROPIC_ORGANIZATION_ID,
+#   ANTHROPIC_SERVICE_ACCOUNT_ID, ANTHROPIC_WORKSPACE_ID
+#       Organization-wide workload identity federation for the Claude API. The
+#       rule must accept this workflow's OIDC subject (a scheduled run on
+#       edera/4.22), which a rule written for pull_request events will not.
 
 on:
   schedule:
@@ -175,7 +175,7 @@ jobs:
       - name: Normalize identifiers
         id: ids
         env:
-          RULE: ${{ vars.REBASE_FEDERATION_RULE_ID || vars.PR_REVIEW_FEDERATION_RULE_ID }}
+          RULE: ${{ vars.ANTHROPIC_FEDERATION_RULE_ID }}
           ORG: ${{ vars.ANTHROPIC_ORGANIZATION_ID }}
           SVC: ${{ vars.ANTHROPIC_SERVICE_ACCOUNT_ID }}
           WS: ${{ vars.ANTHROPIC_WORKSPACE_ID }}
@@ -188,6 +188,17 @@ jobs:
             echo "svc=$(strip "$SVC")"
             echo "ws=$(strip "$WS")"
           } >> "$GITHUB_OUTPUT"
+          # An unset variable otherwise surfaces as an opaque API failure a
+          # second into the model step, with nothing in the log to say why.
+          missing=0
+          for n in FEDERATION_RULE_ID:RULE ORGANIZATION_ID:ORG SERVICE_ACCOUNT_ID:SVC WORKSPACE_ID:WS; do
+            eval "v=\$${n#*:}"
+            if [ -z "$(strip "$v")" ]; then
+              echo "::error::vars.ANTHROPIC_${n%%:*} is empty or not visible to this repository."
+              missing=1
+            fi
+          done
+          exit "$missing"
 
       - name: Rebase
         id: claude