From 99a8670cb894dcd6d57b6d3d5718a96d75473330 Mon Sep 17 00:00:00 2001
From: Ross Imlach <ross@imla.ch>
Date: Fri, 3 Jul 2026 16:23:22 +0100
Subject: [PATCH] fix(ci): fail the broker mint step loudly on broker errors

---
 .github/workflows/cora-review.yml | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/cora-review.yml b/.github/workflows/cora-review.yml
index 80fa179..1eb7f2d 100644
--- a/.github/workflows/cora-review.yml
+++ b/.github/workflows/cora-review.yml
@@ -85,8 +85,10 @@ jobs:
         env:
           BROKER_URL: ${{ secrets.CORA_TOKEN_BROKER_URL }}
         run: |
-          oidc=$(curl -sfS -H "Authorization: Bearer $ACTIONS_ID_TOKEN_REQUEST_TOKEN"             "$ACTIONS_ID_TOKEN_REQUEST_URL&audience=imla-token-broker" | jq -r .value)
-          token=$(curl -sfS -m 10 -X POST -H "Authorization: Bearer $oidc" "$BROKER_URL" | jq -r .token)
+          set -o pipefail
+          oidc=$(curl -sfS -H "Authorization: Bearer $ACTIONS_ID_TOKEN_REQUEST_TOKEN"             "$ACTIONS_ID_TOKEN_REQUEST_URL&audience=imla-token-broker" | jq -re .value)
+          token=$(curl -sfS -m 10 -X POST -H "Authorization: Bearer $oidc" "$BROKER_URL" | jq -re .token)
+          [ -n "$token" ] || { echo "::warning::broker returned empty token"; exit 1; }
           echo "::add-mask::$token"
           echo "token=$token" >> "$GITHUB_OUTPUT"