fix(scripts): guard GITHUB_WORKSPACE fallback against empty/unset values

[fullsend-ai-retro]

What happened

PR #41 (#41) added a workspace-directory fallback for companion script lookup in post-code.sh, post-fix.sh, pre-code.sh, and pre-fix.sh. The fallback iterates over ${GITHUB_WORKSPACE:-}/scripts and ${GITHUB_WORKSPACE:-}/.fullsend/scripts. When GITHUB_WORKSPACE is unset or empty, ${GITHUB_WORKSPACE:-} expands to an empty string, producing absolute paths /scripts and /.fullsend/scripts. The Qodo review bot flagged this as finding #3 ('Fallback can probe /scripts') on post-code.sh line 287. The fullsend review agent did not catch this — its observations focused on GHA workflow command sanitization and code duplication. The human reviewer approved silently without addressing the Qodo finding. The PR was merged with the bug present. The same pattern exists in the upstream fullsend repo via PR fullsend-ai/fullsend#3393.

What could go better

The fallback loop should only run when GITHUB_WORKSPACE is non-empty. On GitHub Actions runners, GITHUB_WORKSPACE is always set by the runner infrastructure, so the practical risk is low — the -f test on /scripts/resolve-precommit-tools.py is extremely unlikely to find anything. However, these scripts execute under set -euo pipefail in a security-sensitive context (push tokens are active), and defensively validating environment assumptions is standard practice for this codebase. Confidence: high that the fix is correct and low-risk. Uncertainty: whether the team considers this worth fixing given the low practical risk.

Proposed change

In all four scripts (scripts/post-code.sh, scripts/post-fix.sh, scripts/pre-code.sh, scripts/pre-fix.sh), wrap the workspace fallback loop in a non-empty guard:

if [ ! -f "${RESOLVE_SCRIPT}" ] || [ ! -f "${INSTALL_SCRIPT}" ]; then
  if [ -n "${GITHUB_WORKSPACE:-}" ]; then
    for _ws_candidate in "${GITHUB_WORKSPACE}/scripts" "${GITHUB_WORKSPACE}/.fullsend/scripts"; do
      # ... existing loop body ...
    done
  fi
fi

The same fix should be applied to the upstream scaffold copies in fullsend-ai/fullsend (internal/scaffold/fullsend-repo/scripts/). This change also applies to the process-fix-result.py fallback in post-fix.sh (lines 350-357).

Validation criteria

After the fix: (1) bash -n syntax check passes on all four scripts. (2) With GITHUB_WORKSPACE unset, the fallback loop does not execute and no paths under / are probed (verify with bash -x). (3) Existing scripts/post-code-test.sh and scripts/post-fix-test.sh test suites continue to pass.

---

Generated by retro agent from #41

[fullsend-ai-triage]

🤖 Finished Triage · ✅ Success · Started 3:52 PM UTC · Completed 3:56 PM UTC
Commit: e8381e3 · View workflow run →

[fullsend-ai-triage]

Triage Summary

Severity: low · Category: bug

Problem

PR #41 added a workspace-directory fallback for companion script lookup. When GITHUB_WORKSPACE is unset or empty, ${GITHUB_WORKSPACE:-} expands to an empty string, producing absolute paths /scripts and /.fullsend/scripts — probing the filesystem root instead of skipping the fallback.

Root Cause

The fallback loop iterates without first checking that GITHUB_WORKSPACE is non-empty. The :- parameter expansion substitutes empty string when unset, which concatenated with /scripts yields the absolute root path.

Affected Files

• scripts/post-code.sh
• scripts/post-fix.sh
• scripts/pre-code.sh
• scripts/pre-fix.sh

Recommended Fix

Wrap each workspace fallback loop in a non-empty guard:

if [ -n "${GITHUB_WORKSPACE:-}" ]; then
  for _ws_candidate in "${GITHUB_WORKSPACE}/scripts" "${GITHUB_WORKSPACE}/.fullsend/scripts"; do
    # ... existing loop body ...
  done
fi

Also apply the same guard to the process-fix-result.py fallback in post-fix.sh.

Proposed Test

# Verify: with GITHUB_WORKSPACE unset, fallback loop does not execute
# and no paths under / are probed
unset GITHUB_WORKSPACE
# Run script under bash -x, grep output for '/_ws_candidate' or '/scripts'
# Expected: no root-path probes appear in trace output
# Existing suites (post-code-test.sh, post-fix-test.sh) must still pass

Notes

• Practical risk is low — GITHUB_WORKSPACE is always set on GHA runners
• The upstream fullsend repo has the same pattern via PR fix(#3069): fall back to workspace scripts dir for script companions fullsend#3393 and should receive the same fix separately
• This is independent of PR fix(scripts): add pre-commit tool resolver and installer #58 (which copies companion scripts into the repo)

---

Labels: This is a confirmed low-severity bug with a clear fix. Marking as bug and ready-to-code since the fix is well-defined and straightforward.

[fullsend-ai-coder]

🤖 Finished Code · ✅ Success · Started 3:57 PM UTC · Completed 4:07 PM UTC
Commit: e8381e3 · View workflow run →