Add deterministic precondition check for CLAUDE_CODE_OAUTH_TOKEN before invoking claude-code-action #90

Problem

mac-dev-server-setup#58 hit a CI failure on claude-review where the job's Claude step failed with CLAUDE_OUTCOME: failure and no verdict was ever rendered. The downstream verdict-parsing logic (in claude-blocking-review.yml) correctly treated this as fail-closed (BLOCK), but the actual root cause — a missing CLAUDE_CODE_OAUTH_TOKEN repo secret — was only surfaced deep in the action's own error output, not called out explicitly by our workflow.

This wasted a CI cycle and required someone to dig through logs to find "the secret isn't set" rather than getting an immediate, clear signal.

Ask

Add a deterministic (non-LLM) precondition check as an early step in claude.yml / claude-blocking-review.yml / claude-assistant.yml (wherever claude-code-action or similar external calls are invoked) that verifies required secrets/config are present before invoking the external action. For example:

- name: Verify required secrets are configured
  run: |
    if [ -z "${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}" ]; then
      echo "::error::CLAUDE_CODE_OAUTH_TOKEN secret is not set for this repository. Add it under Settings > Secrets and variables > Actions."
      exit 1
    fi

This should apply generally — any workflow step that depends on an externally-configured secret/token/API key should fail fast with a clear, actionable error message rather than letting the dependent tool call fail cryptically (and, in the claude-blocking-review case, get misreported as a substantive review BLOCK rather than an infrastructure/config gap).

Why this matters

• Faster diagnosis when onboarding a new repo onto the shared workflow templates (missing secrets is the most common first-run failure).
• Avoids conflating "Claude found a real blocking issue" with "Claude's own invocation was misconfigured" — these should produce clearly distinguishable failure modes in the PR/Actions UI.

Discovered during the smartwatermelon/nightowlstudiollc fleet-wide issue cleanup, 2026-08-07.