[mogita]

Problem

The Stream API key is an identifier, yet CI reads it from a repository secret. A secret cannot be read back, so nobody can see which test app CI runs against.

The Python 3.8 and 3.9 test jobs also fail at setup since ubuntu-latest moved to Ubuntu 26.04, which has no builds of those two versions.

Solution

The workflows read the key from the STREAM_KEY Actions variable. The API secret stays a repository secret.

The test job runs on ubuntu-24.04, the newest image that still has Python 3.8 and 3.9.

How to verify

1. The CI run on this PR passes on all five Python versions with the key coming from the variable.
2. After merge, the scheduled test workflow passes on the default branch and the STREAM_KEY repository secret is deleted.

---

Note

Low Risk
Workflow-only changes; no runtime application code, with the main operational risk being misconfigured repository variables after removing the STREAM_KEY secret.

Overview
CI now sources STREAM_KEY from GitHub Actions variables instead of a repository secret in both the main build workflow and scheduled tests, while STREAM_SECRET remains a secret so the key can be inspected without exposing credentials.

The matrix Test & lint job is pinned to ubuntu-24.04 (with a short comment) so Python 3.8 and 3.9 keep working after ubuntu-latest moved to an image without those runtimes.

^{Reviewed by Cursor Bugbot for commit bbb9ff0. Bugbot is set up for automated code reviews on this repo. Configure here.}