fix(templates): map LITELLM_API_KEY to OPENAI_API_KEY in Temporal workers - #514

Problem

temporal-openai-agents and temporal-pydantic-ai ship an .env.example that only sets LITELLM_API_KEY. In the OpenAI Agents template, project/acp.py copies it into OPENAI_API_KEY; the Pydantic AI template never does. In both, the model call runs in the Temporal worker, a separate process started by agentex agents run, which never gets the mapping. Following either template's own instructions fails in the worker with openai.OpenAIError: Missing credentials after the activity's retries, while the ACP process looks healthy and the task just never answers. (temporal-langgraph is fine: graph.py, which the worker imports, already maps the key.)

Repro: agentex init (Temporal + OpenAI Agents SDK, or Temporal + Pydantic AI), .env with only LITELLM_API_KEY=<openai key>, run against ./dev.sh, send a message: no reply; worker log shows Missing credentials.

Fix

Apply the same three-line mapping (no-op when OPENAI_API_KEY is already set) in both project/run_worker.py templates, and add a parametrized test asserting the worker entrypoints carry it.

Verification

Scaffolded agents against a local backend with only LITELLM_API_KEY set:

• Temporal + OpenAI Agents: before, no reply and Missing credentials x7 retries; after, reply in 4.7 s (gpt-5-nano), zero worker tracebacks.
• Temporal + Pydantic AI: before, same failure; after (together with the CLI .env fix), reply in 4.7 s, zero worker errors.

Depends on / pairs with #515 ("fix(cli): load the agent's .env into locally run ACP and worker processes"): without it, .env reaches the worker only through litellm's import-time load_dotenv(), which is too late for frameworks that build their client at import. The mapping is placed at the top of run_worker.py, before project imports, for that reason.
tests/lib/cli/test_init_templates.py: 28 passed. ruff clean.

Confidence Score: 4/5

The PR is not ready to merge because a generated requirements image can fail to build when its private mirror lacks a public dependency.

What we checked:

• Worker reads the key too late: Both changed entrypoints load .env and map the key before their project imports.

Summary

The PR adds early API-key setup to two Temporal worker templates and makes ACP wait for task creation before replying. It also updates the SDK’s production URL and changes release, security-scanning, and repository CI workflows.

• Keeps Temporal workers from starting model calls without the configured key.
• Makes task creation finish before callers send events.
• Updates the production endpoint and expands CI and release automation.

%%{init: {'theme': 'neutral'}}%%
flowchart LR
  S[Injected index secret] --> D[Requirements Dockerfile]
  D --> M[Private mirror as default]
  M -->|Package present| B[Image builds]
  M -->|Public package missing| F[Image build fails]

_{Reviews (3) · Last reviewed commit: "fix(templates): load the project .env in..."}