Handle missing HUGGING_FACE_TOKEN gracefully in CI

.github/workflows/code_changes.yaml

@@ -50,9 +50,14 @@ jobs:
           - name: UV sync
             run: uv sync
           - name: Run tests with coverage
-            run: make test
+            run: |
+              # Only export token if non-empty (defensive against missing secrets)
+              if [ -n "$HF_TOKEN_VALUE" ]; then
+                export HUGGING_FACE_TOKEN="$HF_TOKEN_VALUE"
+              fi
+              make test
             env:
-              HUGGING_FACE_TOKEN: ${{ secrets.HUGGING_FACE_TOKEN }}
+              HF_TOKEN_VALUE: ${{ secrets.HUGGING_FACE_TOKEN }}
           - name: Upload coverage to Codecov
             uses: codecov/codecov-action@v4
             with:

.github/workflows/pr_code_changes.yaml

@@ -50,9 +50,14 @@ jobs:
           - name: UV sync
             run: uv sync
           - name: Run tests with coverage
-            run: make test
+            run: |
+              # Only export token if non-empty (avoids 'Bearer ' error for Dependabot PRs)
+              if [ -n "$HF_TOKEN_VALUE" ]; then
+                export HUGGING_FACE_TOKEN="$HF_TOKEN_VALUE"
+              fi
+              make test
             env:
-              HUGGING_FACE_TOKEN: ${{ secrets.HUGGING_FACE_TOKEN }}
+              HF_TOKEN_VALUE: ${{ secrets.HUGGING_FACE_TOKEN }}
           - name: Upload coverage to Codecov
             uses: codecov/codecov-action@v4
             with:

changelog_entry.yaml

@@ -0,0 +1,4 @@
+- bump: patch
+  changes:
+    fixed:
+      - CI workflows now handle missing HUGGING_FACE_TOKEN gracefully, allowing Dependabot PRs to run tests without failing on empty Bearer token errors.