fix(ci): tolerate absent secrets and run setup before clippy

Fork pull requests receive no secrets, so secret-env now warns and
skips a missing name instead of failing every leg, matching the inline
jobs it replaces. rust-tests runs setup-script and teardown-script
around clippy too, since build scripts such as blasthttp's vendored
OpenSSL run during clippy.

Author: singlerider

.github/workflows/python-tests.yml

@@ -95,11 +95,11 @@ jobs:
           python3 - <<'PY'
           import json, os, secrets
           values, names = json.loads(os.environ["SECRETS"]), json.loads(os.environ["NAMES"])
-          missing = [n for n in names if n not in values]
-          if missing:
-              raise SystemExit(f"secrets not passed by caller: {missing}")
+          for n in names:
+              if not values.get(n):
+                  print(f"::warning::secret {n} is unavailable, as on fork pull requests")
           with open(os.environ["GITHUB_ENV"], "a") as env:
-              for n in names:
+              for n in filter(values.get, names):
                   delim = secrets.token_hex(16)
                   env.write(f"{n}<<{delim}\n{values[n]}\n{delim}\n")
           PY

.github/workflows/rust-tests.yml

@@ -14,7 +14,7 @@ on:
         type: string
         default: ""
       setup-script:
-        description: Repository script run before the test. It may append to $GITHUB_ENV.
+        description: Repository script run before clippy and before the test. It may append to $GITHUB_ENV.
         type: string
         default: ""
       teardown-script:
@@ -40,11 +40,19 @@ jobs:
         with:
           workspaces: ${{ inputs.working-directory }}
       - run: cargo fmt --all -- --check
+      - if: inputs.setup-script != ''
+        env:
+          SCRIPT: ${{ inputs.setup-script }}
+        run: '"./$SCRIPT"'
       - env:
           CARGO_ARGS: ${{ inputs.cargo-args }}
         run: |
           read -ra args <<<"$CARGO_ARGS"
           cargo clippy --all-targets "${args[@]}" -- -D warnings
+      - if: always() && inputs.teardown-script != ''
+        env:
+          SCRIPT: ${{ inputs.teardown-script }}
+        run: '"./$SCRIPT"'
 
   test:
     runs-on: ubuntu-24.04