From e8448dba067161fcfc0be12e818fb00463115315 Mon Sep 17 00:00:00 2001
From: rgarcia <72655+rgarcia@users.noreply.github.com>
Date: Wed, 11 Nov 2026 16:13:45 +0000
Subject: [PATCH] Read model provider keys from the benchmarks environment

---
 .github/workflows/_run.yml | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/_run.yml b/.github/workflows/_run.yml
index 79768d7..7e59240 100644
--- a/.github/workflows/_run.yml
+++ b/.github/workflows/_run.yml
@@ -35,9 +35,12 @@ jobs:
   run:
     runs-on: ubuntu-latest
     timeout-minutes: 360
-    # Repository and organization secrets; a repository secret overrides an
-    # organization secret with the same name. Every benchmark sees all of
-    # them; suites and agents only read the ones they need.
+    # The model provider keys (Anthropic, OpenAI, OpenRouter) are secrets of
+    # the benchmarks environment, so only this job can read them. No AWS role
+    # trusts this environment. Other secrets are repository or organization
+    # secrets. Every benchmark sees all of them; suites and agents only read
+    # the ones they need.
+    environment: benchmarks
     env:
       BENCHMARK_NAME: ${{ inputs.benchmark }}
       KERNEL_API_KEY: ${{ secrets.KERNEL_API_KEY }}