We've had troubes in the past trying to validate github environment against unset/empty secrets or variables. I've used bash scripts like [ -z "${{ secrets.mysecret }}" ] && exit 1; as first step, but that breaks when secret has special characters. actions expand references in-place, so it seems really hard to get around this.

What are best practices here?