Summary

Fixes the evaluation group of Secure Integration test, red on main since #568 with all six third-party adapter tests failing.

There were two independent causes, and both had to be fixed — the first one masks the second, so neither alone turns the job green.

1. Span fixture shape (FIELD_EXTRACTION_ERROR)

strands-evals' CloudWatchSessionMapper reads message text via content.content / content.message, where the inner value is a JSON-encoded list of content blocks, and selects the CloudWatch format off scope.name:

def _extract_content_field(self, content):
    if not isinstance(content, dict):
        return None                     # <-- a bare string dies here
    return content.get("content") or content.get("message")

The integ fixture passed a bare string and set no scope, so extraction returned None → zero traces → no AgentInvocationSpan → FIELD_EXTRACTION_ERROR with value=None. The repo'"'"'s own unit fixtures already use the correct nested shape (autoevals/test_adapter.py:32); only the integ fixture drifted.

Also removed an inline mutation in test_factuality_scorer that overwrote output.messages with the old bare-string shape — it would have defeated the fix for that one test, and it only reproduced what the helper already builds by default.

2. LLM judge credentials (METRIC_ERROR)

DeepEval and Autoevals both judge with an LLM (GPT by default) and raise before returning when no key is present. Fixing the fixture alone just moves the Autoevals failures from FIELD_EXTRACTION_ERROR to METRIC_ERROR: Missing credentials.

OPENAI_API_KEY is now fetched as a repo-specific workflow secret and exported to the test step, following the GitHub Reusable Workflow Guide.

Infrastructure (already provisioned)

• Secret aws/bedrock-agentcore-sdk-python/OPENAI_API_KEY created in the central DevX account (631957124172, us-east-1), plaintext to match parse-json-secrets: false.
• Its exact ARN granted secretsmanager:GetSecretValue on DevXWorkflowSecretsReader-SDKPython (22 → 23 ARNs, no folder wildcards).
• Trust policy unchanged — the eval job already assumes this role for the existing 15 secrets under both push and pull_request_target.

Precedent: aws/agentcore-cli/E2E_OPENAI_API_KEY already exists in the same account, alongside E2E_ANTHROPIC_API_KEY and E2E_GEMINI_API_KEY. The unprefixed name matches this repo'"'"'s own 15 secrets, none of which use an E2E_ prefix.

Reviewer notes

• These tests now fail rather than skip without OPENAI_API_KEY. A skipif guard was considered and deliberately dropped, so local runs without the key report 6 failures.
• This PR cannot self-verify. It touches .github/workflows/, so safety-gate sets should-run=false and integration tests will not run automatically — a maintainer must trigger them manually. That is the workflow-modification protection behaving as designed.
• Worth pairing with a spend cap and rotation on the key. It becomes reachable from pull_request_target runs; safety-gate and the gated manual-approval environment mitigate this, but nothing in the repo enforces a budget.

Testing

# fixture fix verified with the judge stubbed, proving span mapping reaches it
autoevals  -> value=0.9  errorCode=None  input='What is the capital of France?'  output='The capital of France is Paris.'
deepeval   -> value=0.8  errorCode=None  input='What is the capital of France?'  actual_output='The capital of France is Paris.'

ruff format --check  -> 1 file already formatted
ruff check           -> All checks passed!
workflow YAML        -> parses

I could not exercise the real judge calls locally (no key outside CI), so the first true green run for these six tests will be in CI.