Integration tests: fast-fail on missing credential env vars

src/OctoshiftCLI.IntegrationTests/AdoToGithub.cs

@@ -23,6 +23,10 @@ protected AdoToGithub(ITestOutputHelper output, string adoServerUrl = "https://d
             StartTime = DateTime.Now;
             _output = output;
 
+            TestHelper.AssertCredentialsPresent(
+                (adoPatEnvVar, "Azure DevOps personal access token"),
+                ("GHEC_PAT", "GitHub Enterprise Cloud personal access token"));
+
             var logger = new OctoLogger(x => { }, x => _output.WriteLine(x), x => { }, x => { });
 
             _versionClient = new HttpClient();

src/OctoshiftCLI.IntegrationTests/BbsToGithub.cs

@@ -39,12 +39,19 @@ public BbsToGithub(ITestOutputHelper output)
         _startTime = DateTime.Now;
         _output = output;
 
+        var azureStorageEnvVar = $"AZURE_STORAGE_CONNECTION_STRING_BBS_{TestHelper.GetOsName().ToUpperInvariant()}";
+        TestHelper.AssertCredentialsPresent(
+            ("BBS_USERNAME", "Bitbucket Server username"),
+            ("BBS_PASSWORD", "Bitbucket Server password"),
+            ("GHEC_PAT", "GitHub Enterprise Cloud personal access token"),
+            (azureStorageEnvVar, "Azure blob storage connection string for BBS migration archives"));
+
         _logger = new OctoLogger(_ => { }, x => _output.WriteLine(x), _ => { }, _ => { });
 
         var sourceBbsUsername = Environment.GetEnvironmentVariable("BBS_USERNAME");
         var sourceBbsPassword = Environment.GetEnvironmentVariable("BBS_PASSWORD");
         var targetGithubToken = Environment.GetEnvironmentVariable("GHEC_PAT");
-        _azureStorageConnectionString = Environment.GetEnvironmentVariable($"AZURE_STORAGE_CONNECTION_STRING_BBS_{TestHelper.GetOsName().ToUpper()}");
+        _azureStorageConnectionString = Environment.GetEnvironmentVariable(azureStorageEnvVar);
         _tokens = new Dictionary<string, string>
         {
             ["BBS_USERNAME"] = sourceBbsUsername,

src/OctoshiftCLI.IntegrationTests/GhesToGithub.cs

@@ -36,11 +36,17 @@ public GhesToGithub(ITestOutputHelper output)
         _startTime = DateTime.Now;
         _output = output;
 
+        var azureStorageEnvVar = $"AZURE_STORAGE_CONNECTION_STRING_GHES_{TestHelper.GetOsName().ToUpperInvariant()}";
+        TestHelper.AssertCredentialsPresent(
+            ("GHES_PAT", "GitHub Enterprise Server personal access token"),
+            ("GHEC_PAT", "GitHub Enterprise Cloud personal access token"),
+            (azureStorageEnvVar, "Azure blob storage connection string for GHES migration archives"));
+
         var logger = new OctoLogger(_ => { }, x => _output.WriteLine(x), _ => { }, _ => { });
 
         var sourceGithubToken = Environment.GetEnvironmentVariable("GHES_PAT");
         var targetGithubToken = Environment.GetEnvironmentVariable("GHEC_PAT");
-        _azureStorageConnectionString = Environment.GetEnvironmentVariable($"AZURE_STORAGE_CONNECTION_STRING_GHES_{TestHelper.GetOsName().ToUpper()}");
+        _azureStorageConnectionString = Environment.GetEnvironmentVariable(azureStorageEnvVar);
         _tokens = new Dictionary<string, string>
         {
             ["GH_SOURCE_PAT"] = sourceGithubToken,

src/OctoshiftCLI.IntegrationTests/GithubToGithub.cs

@@ -26,6 +26,9 @@ public GithubToGithub(ITestOutputHelper output)
             _startTime = DateTime.Now;
             _output = output;
 
+            TestHelper.AssertCredentialsPresent(
+                ("GHEC_PAT", "GitHub Enterprise Cloud personal access token"));
+
             var logger = new OctoLogger(x => { }, x => _output.WriteLine(x), x => { }, x => { });
 
             var githubToken = Environment.GetEnvironmentVariable("GHEC_PAT");

src/OctoshiftCLI.IntegrationTests/TestHelper.cs

@@ -526,6 +526,36 @@ public static string GetOsName()
                 : throw new InvalidOperationException("Could not determine OS");
         }
 
+        /// <summary>
+        /// Validates that required environment variables for credentials are set and non-empty.
+        /// Throws an InvalidOperationException with a clear message identifying which env var is missing.
+        /// Call this at the start of integration test constructors for fast-fail with actionable error messages.
+        /// </summary>
+        public static void AssertCredentialsPresent(params (string envVarName, string description)[] credentials)
+        {
+            if (credentials is null)
+            {
+                throw new ArgumentNullException(nameof(credentials));
+            }
+
+            var missing = new List<string>();
+            foreach (var (envVarName, description) in credentials)
+            {
+                var value = Environment.GetEnvironmentVariable(envVarName);
+                if (string.IsNullOrWhiteSpace(value))
+                {
+                    missing.Add($"  - {envVarName}: {description}");
+                }
+            }
+
+            if (missing.Any())
+            {
+                throw new InvalidOperationException(
+                    $"Missing or empty credential environment variable(s). " +
+                    $"If these are GitHub Actions secrets, they may need to be rotated:\n{string.Join("\n", missing)}");
+            }
+        }
+
         public async Task RunCliMigration(string generateScriptCommand, string cliName, IReadOnlyDictionary<string, string> tokens)
         {
             await RunCliCommand(generateScriptCommand, cliName, tokens);