Two additional cost-prevention measures on top of the secret + repo-identity
gate from the previous commit:

1. paths: filter — only trigger integration tests when base-action/, the
   workflow file itself, or Bun/TS config changes. Non-base-action PRs (docs,
   Gitea action code, hooks, etc.) skip the tests entirely. Preserves manual
   coverage via workflow_dispatch.

2. concurrency: group + cancel-in-progress — rapid force-pushes on the same
   branch cancel in-flight runs instead of paying for all of them. Typical
   PR iteration (5-10 force-pushes during review) drops from ~31*N billed
   runs to ~31 billed runs.

Test-claude-env.yml also filters its push-to-main trigger to match (only run
when base-action-affecting files land on main).

Copilot review on PR #3 caught that this workflow was the only one passing
only anthropic_api_key without claude_code_oauth_token. With an OAuth-only
repo config (CLAUDE_CREDENTIALS set, ANTHROPIC_API_KEY unset) the new gate
lets the job run but base-action env validation fails at the pre-auth step.

Align with the other test-*.yml workflows: pass both, with ANTHROPIC_API_KEY
taking precedence when both are set and CLAUDE_CREDENTIALS feeding the
oauth token input.

Workflow dispatch revealed that every test-*.yml + ci-all.yml was rejected
at parse time:

  Unrecognized named-value: 'secrets'.
  (secrets.CLAUDE_CREDENTIALS != '' || secrets.ANTHROPIC_API_KEY != '')

GitHub Actions does NOT allow the `secrets` context in job-level `if:`
expressions. The earlier "0 jobs, conclusion=failure" runs I attributed
to degenerate state were actually parse failures — the workflows never
dispatched. The fork-check half of the gate was never evaluated.

Keep only the fork-check half, which uses `github.event.pull_request.*`
and is valid:

    if: >-
      github.event_name != 'pull_request' ||
      github.event.pull_request.head.repo.full_name == github.repository

This still closes the fork-PR cost vector (fork PRs skip). It no longer
skip-cleans when secrets are unset on the main fork — in that case base-
action's env validator fails red, same as before the gate. Acceptable
because `CLAUDE_CREDENTIALS` is now set on nllptrx/claude-code-action.

Also fix the test-structured-output summary `if:` where the bulk rewrite
produced wrong operator precedence: `always() && A || B` means `(always()
&& A) || B`. Add explicit parens.

If we later want skip-clean-on-missing-secret, the correct pattern is a
preflight job that outputs a boolean via GITHUB_OUTPUT, then `needs: +
if: needs.preflight.outputs.has_creds` on each downstream job. Not
needed for now.

Upstream pattern:
  anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY && secrets.ANTHROPIC_API_KEY || secrets.CLAUDE_CREDENTIALS }}
  claude_code_oauth_token: ${{ secrets.CLAUDE_CREDENTIALS }}

Assumed CLAUDE_CREDENTIALS is a backup **API key**. With an OAuth token in
CLAUDE_CREDENTIALS (current nllptrx config), both inputs received the
OAuth string — base-action's Anthropic client picked it up as x-api-key,
API returned "Invalid API key". All 6 dispatched runs failed on
SDK-execution.

Feed only ANTHROPIC_API_KEY into anthropic_api_key, OAuth stays in its
own channel. base-action's dual-path env setup handles the rest.

When base-action was synced from upstream, claude_env was dropped from
action.yml (upstream removed it in the SDK switchover). We kept the
parseClaudeEnv helper in run-claude.ts as a fork delta but never:

1. Re-declared claude_env in base-action/action.yml — GitHub Actions
   only emits INPUT_* env vars for declared inputs, so callers got a
   silent warning "Unexpected input(s) 'claude_env'" and the value
   was dropped before reaching our code.

2. Wired INPUT_CLAUDE_ENV into the runClaude() call in index.ts —
   the helper lived dead downstream.

Both halves restored. Fixes test-claude-env integration failure on
PR #3 (job 72583417897), where VAR1/VAR2 were never injected into
the Claude process and the echo assertion failed.

548 tests still pass.

Upstream dropped the allowed_tools / timeout_minutes inputs from
base-action; they get silently ignored as "Unexpected input(s)". The
Bash tool defaults to permission-denied without an explicit grant, so
the echo test never executed and VAR1/VAR2 weren't printed to the
transcript — grep found nothing and the assertion failed even though
claude_env injection itself was working.

Move the permission grant into claude_args, which IS a declared input.
Drop timeout_minutes entirely (SDK-level timeout isn't exposed as an
action input; the composite action's shell-level timeout was removed
with the CLI-subprocess switch).

Verified the claude_env fix separately: the warning output on the
previous run confirms claude_env was accepted and parsed ("Comments in
claude_env handled correctly" was echoed); only the Bash permission
blocked the actual variable expansion from landing in the log.

…ssful workflows)

Composite-action run: steps don't auto-surface INPUT_* env vars from
declared inputs — each has to be mapped into the step's env: block.
I added the input declaration earlier (commit d96b464) but missed
wiring it here, so process.env.INPUT_CLAUDE_ENV was undefined,
parseClaudeEnv returned {}, and Claude's Bash tool saw empty
\$VAR1 / \$VAR2.

Diagnostic dump from run 24801530252 confirmed:

  tool_use:    "command": "echo \"VAR1: \$VAR1\" && echo \"VAR2: \$VAR2\""
  tool_result: "content": "VAR1: \nVAR2:"

With this wired, the test's grep for value1/value2 should finally hit.

Also drops the temporary diagnostic dump from test-claude-env.yml
now that it's served its purpose.