Integration tests: fast-fail on missing credential env vars

Add TestHelper.AssertCredentialsPresent() that validates required
environment variables are set and non-empty at test construction time.
Each integration test class now calls this before making any API calls,
producing an immediate, actionable error message identifying which
GitHub Actions secret needs rotating.

Author: offbyone

src/OctoshiftCLI.IntegrationTests/AdoToGithub.cs

@@ -23,6 +23,10 @@ protected AdoToGithub(ITestOutputHelper output, string adoServerUrl = "https://d
             StartTime = DateTime.Now;
             _output = output;
 
+            TestHelper.AssertCredentialsPresent(
+                (adoPatEnvVar, "Azure DevOps personal access token"),
+                ("GHEC_PAT", "GitHub Enterprise Cloud personal access token"));
+
             var logger = new OctoLogger(x => { }, x => _output.WriteLine(x), x => { }, x => { });
 
             _versionClient = new HttpClient();

src/OctoshiftCLI.IntegrationTests/BbsToGithub.cs

@@ -39,12 +39,19 @@ public BbsToGithub(ITestOutputHelper output)
         _startTime = DateTime.Now;
         _output = output;
 
+        var azureStorageEnvVar = $"AZURE_STORAGE_CONNECTION_STRING_BBS_{TestHelper.GetOsName().ToUpperInvariant()}";
+        TestHelper.AssertCredentialsPresent(
+            ("BBS_USERNAME", "Bitbucket Server username"),
+            ("BBS_PASSWORD", "Bitbucket Server password"),
+            ("GHEC_PAT", "GitHub Enterprise Cloud personal access token"),
+            (azureStorageEnvVar, "Azure blob storage connection string for BBS migration archives"));
+
         _logger = new OctoLogger(_ => { }, x => _output.WriteLine(x), _ => { }, _ => { });
 
         var sourceBbsUsername = Environment.GetEnvironmentVariable("BBS_USERNAME");
         var sourceBbsPassword = Environment.GetEnvironmentVariable("BBS_PASSWORD");
         var targetGithubToken = Environment.GetEnvironmentVariable("GHEC_PAT");
-        _azureStorageConnectionString = Environment.GetEnvironmentVariable($"AZURE_STORAGE_CONNECTION_STRING_BBS_{TestHelper.GetOsName().ToUpper()}");
+        _azureStorageConnectionString = Environment.GetEnvironmentVariable(azureStorageEnvVar);
         _tokens = new Dictionary<string, string>
         {
             ["BBS_USERNAME"] = sourceBbsUsername,

src/OctoshiftCLI.IntegrationTests/GhesToGithub.cs

@@ -36,11 +36,17 @@ public GhesToGithub(ITestOutputHelper output)
         _startTime = DateTime.Now;
         _output = output;
 
+        var azureStorageEnvVar = $"AZURE_STORAGE_CONNECTION_STRING_GHES_{TestHelper.GetOsName().ToUpperInvariant()}";
+        TestHelper.AssertCredentialsPresent(
+            ("GHES_PAT", "GitHub Enterprise Server personal access token"),
+            ("GHEC_PAT", "GitHub Enterprise Cloud personal access token"),
+            (azureStorageEnvVar, "Azure blob storage connection string for GHES migration archives"));
+
         var logger = new OctoLogger(_ => { }, x => _output.WriteLine(x), _ => { }, _ => { });
 
         var sourceGithubToken = Environment.GetEnvironmentVariable("GHES_PAT");
         var targetGithubToken = Environment.GetEnvironmentVariable("GHEC_PAT");
-        _azureStorageConnectionString = Environment.GetEnvironmentVariable($"AZURE_STORAGE_CONNECTION_STRING_GHES_{TestHelper.GetOsName().ToUpper()}");
+        _azureStorageConnectionString = Environment.GetEnvironmentVariable(azureStorageEnvVar);
         _tokens = new Dictionary<string, string>
         {
             ["GH_SOURCE_PAT"] = sourceGithubToken,

src/OctoshiftCLI.IntegrationTests/GithubToGithub.cs

@@ -26,6 +26,9 @@ public GithubToGithub(ITestOutputHelper output)
             _startTime = DateTime.Now;
             _output = output;
 
+            TestHelper.AssertCredentialsPresent(
+                ("GHEC_PAT", "GitHub Enterprise Cloud personal access token"));
+
             var logger = new OctoLogger(x => { }, x => _output.WriteLine(x), x => { }, x => { });
 
             var githubToken = Environment.GetEnvironmentVariable("GHEC_PAT");

src/OctoshiftCLI.IntegrationTests/TestHelper.cs

@@ -526,6 +526,36 @@ public static string GetOsName()
                 : throw new InvalidOperationException("Could not determine OS");
         }
 
+        /// <summary>
+        /// Validates that required environment variables for credentials are set and non-empty.
+        /// Throws an InvalidOperationException with a clear message identifying which env var is missing.
+        /// Call this at the start of integration test constructors for fast-fail with actionable error messages.
+        /// </summary>
+        public static void AssertCredentialsPresent(params (string envVarName, string description)[] credentials)
+        {
+            if (credentials is null)
+            {
+                throw new ArgumentNullException(nameof(credentials));
+            }
+
+            var missing = new List<string>();
+            foreach (var (envVarName, description) in credentials)
+            {
+                var value = Environment.GetEnvironmentVariable(envVarName);
+                if (string.IsNullOrWhiteSpace(value))
+                {
+                    missing.Add($"  - {envVarName}: {description}");
+                }
+            }
+
+            if (missing.Any())
+            {
+                throw new InvalidOperationException(
+                    $"Missing or empty credential environment variable(s). " +
+                    $"If these are GitHub Actions secrets, they may need to be rotated:\n{string.Join("\n", missing)}");
+            }
+        }
+
         public async Task RunCliMigration(string generateScriptCommand, string cliName, IReadOnlyDictionary<string, string> tokens)
         {
             await RunCliCommand(generateScriptCommand, cliName, tokens);