Thanks @jstlaurent ! I'm surprised that this has been working locally but now fails in the CICD. Is this needed because os.getenv() returns an empty string rather than None for PRs opened by external contributors? To predict our CICD secrets, presumably?

Yep. When a PR comes from a fork, the secrets are present as environment variables, but they contain an empty string. Why GitHub chose this, I honestly don't understand... When using os.getenv(), the variable exists, so the None default value does not get returned. And since we test for is None, the test passes.

I updated the Pydantic settings class to env_ignore_empty=True, so empty values will use the default of None set in the class for these environment variables.

If we need to expose secrets to external contributors, we can create deployment environments and invite folks there. That way, we can control who gets access. I don't think we need this right now, but it's an option for the future.