privilegedescalation-engineer[bot]
3d7e7d1dff
Adds a check-secrets job that runs before any expensive work. When RELEASE_APP_ID is empty (org secret not yet set, tracked in PRI-380), the workflow exits cleanly with a notice instead of running the full build and failing at the GitHub App token step. Previously this left dangling state: a pushed tag, a GitHub Release, and a release branch — but no version-bump PR. Now the workflow skips all of that and exits clean. Co-Authored-By: Paperclip <noreply@paperclip.ing>