chore(ci): wire DEEPSEEK_API_KEY through the Harness E2E workflows

[ytallo]

Summary

• Declare the optional deepseek_api_key secret in the reusable _harness-e2e.yml and export it as DEEPSEEK_API_KEY in both run steps (source and registry stacks)
• Forward the repo secret from every caller (harness-e2e-main, harness-e2e-daily, harness-e2e-deployed)
• Add provider-deepseek -> target to the E2E Rust cache workspaces

Context

provider-deepseek (#691) resolves its credential from DEEPSEEK_API_KEY on the router; without this wiring a deepseek subject or judge never discovers models in CI (wait_for_model times out). Prerequisite for switching HARNESS_E2E_SUBJECTS to deepseek-v4-flash (judge stays zai/glm-5.2).

Validated locally: direct_answer and persistent_state PASS with deepseek-v4-pro; full sweep with deepseek-v4-flash in progress.

Note: the DeepSeek API now serves only deepseek-v4-flash/deepseek-v4-pro — the deepseek-chat/deepseek-reasoner aliases were retired upstream. Discovery picks the new ids up automatically (curated-table misses land on conservative defaults).

Summary by CodeRabbit

• Chores
  • Added optional DeepSeek API key support for automated end-to-end testing.
  • Updated scheduled, deployed, main, and release workflows to securely pass the configured key when available.
  • Existing workflows remain compatible when no DeepSeek key is provided.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
workers	Ready	Preview	Aug 4, 2026 8:07pm
workers-tech-spec	Ready	Preview	Aug 4, 2026 8:07pm

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: b6c19fd9-e5ec-4f69-9e82-9d7785650623

📥 Commits

Reviewing files that changed from the base of the PR and between 2b3fc59 and 39e06f0.

📒 Files selected for processing (5)

• .github/workflows/_harness-e2e.yml
• .github/workflows/harness-e2e-daily.yml
• .github/workflows/harness-e2e-deployed.yml
• .github/workflows/harness-e2e-main.yml
• .github/workflows/release.yml

---

📝 Walkthrough

Walkthrough

Harness E2E workflows now accept an optional DeepSeek API key. Caller workflows pass the repository secret to the reusable workflow, which caches the DeepSeek provider workspace and exposes the key to source-stack and deployed-stack scenarios.

Changes

DeepSeek E2E integration

Layer / File(s)	Summary
Reusable E2E workflow support .github/workflows/_harness-e2e.yml	The reusable workflow declares the optional secret, caches provider-deepseek, and passes DEEPSEEK_API_KEY to both E2E scenario types.
Workflow caller propagation .github/workflows/harness-e2e-daily.yml, .github/workflows/harness-e2e-deployed.yml, .github/workflows/harness-e2e-main.yml, .github/workflows/release.yml	All listed workflow callers pass secrets.DEEPSEEK_API_KEY as deepseek_api_key.

Estimated code review effort: 1 (Trivial) | ~5 minutes

Possibly related PRs

• iii-hq/workers#692: Updates related Harness E2E workflows for candidate-validation configuration propagation.

Suggested labels: no-ticket

Suggested reviewers: andersonleal

Poem

A rabbit carries a key through the flow,
DeepSeek joins the tests below.
Source and deployed stacks receive the fare,
Cached provider crates wait there.
E2E hops onward, light as air.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes wiring DEEPSEEK_API_KEY through the Harness E2E workflows.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches 💡 1

🛠️ Fix failing CI checks 💡

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch chore/harness-e2e-deepseek-key

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

skill-check — worker

0 verified, 54 skipped (no docs/).

Layer	Result
structure	✓
vale	✓
ai	✓
render	✓

Four for four. Nicely done.