[fix]. Validate required startup secrets

tests/test_main_env_validation.py

@@ -6,6 +6,25 @@ from gitea_codex_bot.config import get_settings
 from gitea_codex_bot.main import _validate_required_env
 
 
+@pytest.mark.parametrize(
+    ("env_name", "env_value", "error_text"),
+    [
+        ("GITEA_WEBHOOK_SECRET", "   ", "GITEA_WEBHOOK_SECRET is required"),
+        ("GITEA_TOKEN", "   ", "GITEA_TOKEN is required"),
+        ("ALLOWED_REPOS", "   ", "ALLOWED_REPOS is required"),
+    ],
+)
+def test_validate_required_env_fails_on_blank_required_settings(
+    monkeypatch: pytest.MonkeyPatch, env_name: str, env_value: str, error_text: str
+) -> None:
+    monkeypatch.setenv(env_name, env_value)
+    get_settings.cache_clear()
+    settings = get_settings()
+
+    with pytest.raises(RuntimeError, match=error_text):
+        _validate_required_env(settings)
+
+
 def test_validate_required_env_requires_api_key_in_api_key_mode(monkeypatch: pytest.MonkeyPatch) -> None:
     monkeypatch.setenv("OPENAI_API_KEY", "")
     monkeypatch.setenv("CODEX_AUTH_MODE", "api_key")