chore: add dispatch workflow to trigger agent digest sync by ggallen · Pull Request #882 · fullsend-ai/agents

ggallen · 2026-08-19T13:26:54Z

Summary

Adds a post-merge workflow that fires a repository_dispatch event to fullsend-ai/.fullsend whenever agents main is updated
This triggers the sync-agent-digests workflow (Replace renovate agent digest tracking with sync workflow .fullsend#174) to propagate the new agent commit digest and sha256 hashes across all fullsend-ai repos
Includes a failure notification job that alerts Slack if the dispatch fails

Prerequisites

SYNC_CLIENT_ID variable set on this repo (App Client ID, Iv23...-style)
SYNC_PRIVATE_KEY secret set on this repo
SLACK_WEBHOOK_URL secret set on this repo (same value as on fullsend-ai/fullsend)

Test plan

Merge a change to agents main
Verify the dispatch fires and sync-agent-digests runs in .fullsend
Confirm all repos converge to the new digest

🤖 Generated with Claude Code

qodo-code-review · 2026-08-19T13:27:52Z

PR Summary by Qodo

Notify .fullsend to Sync Agent Digests After Main Pushes

✨ Enhancement ⚙️ Configuration changes 🕐 Less than 10 minutes

AI Description

• Dispatches agent update events to .fullsend after pushes to main.
• Authenticates cross-repository requests with a GitHub App token.
• Includes the source commit SHA for digest synchronization.

Diagram

graph TD
  A["Main Push"] --> B["Notify Workflow"] --> C{"Fullsend owner?"}
  C -->|Yes| D["App Token"] --> E["Repository Dispatch"] --> F["Digest Sync"] --> G["Fullsend Repos"]
  C -->|No| H["Skip Job"]

High-Level Assessment

The following are alternative approaches to this PR:

1. Direct workflow_dispatch

➕ Targets the synchronization workflow explicitly.
➕ Can expose defined and validated workflow inputs.
➖ Couples this repository to the downstream workflow filename and interface.
➖ Provides weaker event-oriented separation than repository_dispatch.

2. Downstream polling

➕ Requires no cross-repository dispatch credentials in this repository.
➕ Can recover automatically from missed notifications.
➖ Introduces synchronization latency and recurring API usage.
➖ Requires state tracking to detect new agent commits.

Recommendation: Keep the repository_dispatch approach because the downstream event handler already exists and the event payload cleanly carries the source SHA. GitHub App authentication is preferable to a personal access token because it provides short-lived, centrally managed credentials; repository variables and secrets must be configured before merging.

Files changed (1) +29 / -0

Other (1) +29 / -0

notify-agent-sync.ymlAdd cross-repository agent digest synchronization notification +29/-0

Add cross-repository agent digest synchronization notification

• Adds a main-branch workflow that creates a GitHub App token and sends an 'agents-updated' repository dispatch to 'fullsend-ai/.fullsend', including the pushed commit SHA. The owner guard prevents execution in forks, while empty workflow permissions minimize the default token's privileges.

.github/workflows/notify-agent-sync.yml

fullsend-ai-review · 2026-08-19T13:28:56Z

🤖 Finished Review · ✅ Success · Started 1:28 PM UTC · Completed 1:44 PM UTC

Commit: 47526bd · View workflow run →

qodo-code-review · 2026-08-19T13:31:44Z

Code Review by Qodo

🐞 Bugs (0) 📘 Rule violations (0) 📜 Skill insights (1)

1. Protected workflow requires human approval 📜 Skill insight § Compliance

Description

This PR adds .github/workflows/notify-agent-sync.yml, a protected infrastructure path that must
receive human review and cannot be auto-approved. The PR explains the workflow's purpose, but
protected-path review remains mandatory.

Code

.github/workflows/notify-agent-sync.yml[R5-7]
+on:
+  push:
+    branches: [main]

Relevance

●●● Strong
Protected .github path changes consistently flagged for human review per repo precedent.
PR-#29
PR-#184

ⓘ Recommendations generated based on similar findings in past PRs

Evidence

Rule 1538392 explicitly designates .github/ as a protected governance and infrastructure path and
requires a finding whenever it is modified. The cited lines introduce the workflow trigger within
that protected path.

.github/workflows/notify-agent-sync.yml[5-7]
Skill: pr-review

2. ~~Workflow behavior lacks automated test~~ ✗ Dismissed 📜 Skill insight ▣ Testability

Description

The new workflow introduces a cross-repository dispatch side effect without adding or updating any
automated test that validates the event type, payload, or destination. The unchecked manual test
plan does not satisfy the requirement for a corresponding test change.

Code

.github/workflows/notify-agent-sync.yml[R27-29]

+          gh api repos/fullsend-ai/.fullsend/dispatches \
+            -f event_type=agents-updated \
+            -f "client_payload[sha]=${{ github.sha }}"

Relevance

●●● Strong
Team has accepted adding tests for new workflow/script behavioral logic recently.
PR-#635

ⓘ Recommendations generated based on similar findings in past PRs

Evidence
Rule 1538339 requires every behavioral change to have a corresponding test change. The PR adds the
dispatch side effect at these lines but contains no test-file modification.
.github/workflows/notify-agent-sync.yml[23-29]
Skill: code-implementation

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
The new dispatch workflow has no automated test covering its observable behavior.

## Issue Context
Add a test that parses or exercises the workflow and constrains the destination repository, `agents-updated` event type, and SHA payload. Integrate it with the repository's existing workflow or script test conventions.

## Fix Focus Areas
- .github/workflows/notify-agent-sync.yml[23-29]

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

3. ~~App token scope is overbroad~~ ✓ Resolved 📜 Skill insight ⛨ Security

Description

Specifying only owner: fullsend-ai creates an installation token covering every repository
accessible to the app, although the workflow only dispatches to .fullsend. This exceeds the stated
use case and lacks linked authorization for the broader scope.

Code

.github/workflows/notify-agent-sync.yml[21]
+          owner: fullsend-ai

Relevance

●● Moderate
Least-privilege permission concerns are raised for workflows but often only partially accepted.
PR-#25

ⓘ Recommendations generated based on similar findings in past PRs

Evidence

Compliance rule 1538316 requires permission expansions to use the least-privilege alternative and
have explicit authorization. The token configuration supplies the organization owner without a
repositories restriction, while the subsequent operation only needs .fullsend.

.github/workflows/notify-agent-sync.yml[18-21]
Skill: code-review

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
The GitHub App token is scoped to all repositories accessible to the app rather than only the destination repository.

## Issue Context
The workflow only calls `repos/fullsend-ai/.fullsend/dispatches`. Configure the token action's repository restriction so compromise or misuse cannot affect other repositories.

## Fix Focus Areas
- .github/workflows/notify-agent-sync.yml[18-21]

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

4. ~~Sync configuration lacks repository documentation~~ ✓ Resolved 📜 Skill insight ⚙ Maintainability

Description

The workflow introduces required SYNC_APP_ID and SYNC_PRIVATE_KEY configuration keys without
updating persistent in-repository documentation. Maintainers relying on repository documentation
will not know these values must be provisioned for dispatches to work.

Code

.github/workflows/notify-agent-sync.yml[R19-20]

+          app-id: ${{ vars.SYNC_APP_ID }}
+          private-key: ${{ secrets.SYNC_PRIVATE_KEY }}

Relevance

●● Moderate
Documentation requests for new config keys appear occasionally but no strong precedent for this
exact case.
PR-#25

ⓘ Recommendations generated based on similar findings in past PRs

Evidence

Rule 1538385 requires new configuration keys and behavioral changes to be reflected in repository
documentation. These lines introduce two required configuration identifiers, while the PR includes
no documentation-file change.

.github/workflows/notify-agent-sync.yml[19-20]
Skill: pr-review

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
The newly required GitHub Actions variable and secret are not documented in the repository.

## Issue Context
Document `SYNC_APP_ID`, `SYNC_PRIVATE_KEY`, their purpose, required GitHub App access, and where maintainers configure them. The PR description alone is not persistent repository documentation.

## Fix Focus Areas
- .github/workflows/notify-agent-sync.yml[19-20]

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

Context sources

✅ Compliance rules (platform): 55 rules

✅ Skills: 4 invoked

code-review

code-implementation

pr-review

docs-review

Tip of the day

💡 Did you know, you can copy the agent prompt from any finding and feed it to your IDE agent

More tips ↗ | Customize Qodo ↗ | Qodo docs ↗

fullsend-ai-review · 2026-08-19T13:44:03Z

Review

Findings

High

[protected-path] .github/workflows/notify-agent-sync.yml, AGENTS.md — This PR modifies files under protected paths (.github/ and AGENTS.md). No linked issue provides authorization for these governance/infrastructure changes. Human approval is required for all protected-path modifications.
Remediation: Link the PR to an issue that authorizes the changes to .github/ and AGENTS.md, or obtain explicit human reviewer approval for these protected-path modifications.

Medium

[missing-authorization] — No linked issue found for this PR. This is a non-trivial change that introduces a new cross-repo integration workflow (68 lines of new infrastructure code plus documentation updates). Per project guidelines, non-trivial changes should have explicit authorization via a linked issue to establish scope boundaries.
Remediation: Link the PR to the issue that authorized this cross-repo digest sync integration, or create a tracking issue retroactively and link it.

Next steps:

/fs-fix — agent addresses review findings automatically
/fs-fix <your instruction> — agent fixes with your specific guidance
Push commits directly — review re-runs automatically on push
/fs-fix-stop — disable automatic fix runs for this PR

Previous run

Review

Findings

High

[protected-path] .github/workflows/notify-agent-sync.yml, AGENTS.md — This PR modifies files under protected paths (.github/ and AGENTS.md) but has no linked issue authorizing changes to governance or infrastructure files. Human approval is always required for protected-path changes, regardless of the rationale provided in the PR description.
Remediation: Link this PR to an issue in this repository that authorizes the infrastructure changes, or obtain explicit human approval for the protected-path modifications.

Next steps:

/fs-fix — agent addresses review findings automatically
/fs-fix <your instruction> — agent fixes with your specific guidance
Push commits directly — review re-runs automatically on push
/fs-fix-stop — disable automatic fix runs for this PR

Previous run (2)

Review

Findings

High

[protected-path] .github/workflows/notify-agent-sync.yml, AGENTS.md — This PR modifies files under protected paths (.github/, AGENTS.md). The PR has no linked issue to justify modifying governance and infrastructure files. Human approval is always required for protected-path changes.
Remediation: Link an issue authorizing the change, and ensure a human maintainer reviews and approves the protected-path modifications.

Medium

[missing-authorization] .github/workflows/notify-agent-sync.yml — This PR introduces a non-trivial change (new CI workflow with cross-repo permissions, documentation updates across two files, 65+ new lines) but has no linked issue. Non-trivial changes require explicit authorization via a linked issue to establish scope and provide an audit trail.
Remediation: Link an issue that authorizes this work, or create one retroactively documenting the motivation for the cross-repo agent digest sync mechanism.

Next steps:

/fs-fix — agent addresses review findings automatically
/fs-fix <your instruction> — agent fixes with your specific guidance
Push commits directly — review re-runs automatically on push
/fs-fix-stop — disable automatic fix runs for this PR

Previous run (3)

Review

Findings

High

[protected-path] .github/workflows/notify-agent-sync.yml, AGENTS.md — This PR modifies files under protected paths (.github/, AGENTS.md). The PR has no linked issue providing authorization for modifying governance and infrastructure files. Human approval is required for all protected-path changes. Affected protected files: .github/workflows/notify-agent-sync.yml, AGENTS.md.

Low

[error handling] .github/workflows/notify-agent-sync.yml:57 — The Slack notification step does not guard against an empty SLACK_WEBHOOK_URL secret. If the secret is not configured, $SLACK_WEBHOOK will be an empty string and curl will fail with a non-obvious error (curl: no URL specified), making it harder to diagnose the missing configuration.
See also: [error-handling idiom] finding at this location.
[error-handling idiom] .github/workflows/notify-agent-sync.yml:57 — The Notify Slack step's run block does not begin with set -euo pipefail. The Dispatch sync step in this same workflow uses it (line 42), creating an intra-file inconsistency.
See also: [error handling] finding at this location.

Next steps:

/fs-fix — agent addresses review findings automatically
/fs-fix <your instruction> — agent fixes with your specific guidance
Push commits directly — review re-runs automatically on push
/fs-fix-stop — disable automatic fix runs for this PR

Previous run (4)

Review

Findings

High

[protected-path] .github/workflows/notify-agent-sync.yml, AGENTS.md — This PR modifies files under protected paths (.github/, AGENTS.md). The PR has no linked issue providing authorization context for these governance/infrastructure file changes. Human approval is always required for protected-path changes.
Remediation: Link an authorizing issue to this PR, or obtain explicit human approval for the protected-path changes.

Low

[code-organization] .github/workflows/notify-agent-sync.yml:26 — The notify job omits a permissions: {} block. In functional-tests.yml, which also sets top-level permissions: {}, every job explicitly declares its own permissions. Adding an explicit permissions: {} at the job level would be consistent with the codebase convention and make the intent clear.
Remediation: Add permissions: {} to the notify job, matching the pattern in functional-tests.yml and the notify-failure job in this same file.

Info

[provenance-warning] — Prior review context discarded: provenance validation failed (unverifiable-wrong-app). This review treats all findings as first-time assessments.

Next steps:

/fs-fix — agent addresses review findings automatically
/fs-fix <your instruction> — agent fixes with your specific guidance
Push commits directly — review re-runs automatically on push
/fs-fix-stop — disable automatic fix runs for this PR

Previous run (5)

Review

Findings

High

[protected-path] .github/workflows/notify-agent-sync.yml, AGENTS.md — This PR modifies files under protected paths (.github/, AGENTS.md). The PR has no linked issue providing authorization for changes to governance or infrastructure files. Human approval is required for protected-path changes regardless of technical quality.
Remediation: Link an issue that authorizes this change, or obtain explicit human approval for the protected-path modifications.

Low

[contract-schema] .github/workflows/notify-agent-sync.yml:42 — The client_payload lacks a schema version field. If the consumer later needs additional fields, there is no versioning mechanism to negotiate schema evolution.
Remediation: Consider adding a version field: -f 'client_payload[version]=1'.
[contract-resilience] .github/workflows/notify-agent-sync.yml:40 — The dispatch step has no retry logic. A transient GitHub API failure leaves downstream repos on stale agent hashes until the next push to main.
Remediation: Add a retry wrapper around the gh api call.
[permission-convention] .github/workflows/notify-agent-sync.yml:50 — The notify-failure job declares permissions: contents: read but never reads repository contents. permissions: {} would be sufficient.
[incomplete-docs] AGENTS.md:75 — The entry for notify-agent-sync.yml mentions SYNC_CLIENT_ID and SYNC_PRIVATE_KEY but omits SLACK_WEBHOOK_URL, which is also required by the notify-failure job.
Remediation: Append , and SLACK_WEBHOOK_URL secret (for failure alerts) to the AGENTS.md bullet.

Next steps:

/fs-fix — agent addresses review findings automatically
/fs-fix <your instruction> — agent fixes with your specific guidance
Push commits directly — review re-runs automatically on push
/fs-fix-stop — disable automatic fix runs for this PR

Previous run (6)

Review

Findings

High

[protected-path] .github/workflows/notify-agent-sync.yml, AGENTS.md — This PR modifies files under protected paths (.github/, AGENTS.md) which are governance and infrastructure files requiring human approval. The PR has no linked issue providing authorization for these changes. Protected files: .github/workflows/notify-agent-sync.yml, AGENTS.md. Human approval is always required for protected-path changes.
Remediation: Link an authorizing issue to this PR, or obtain explicit human reviewer approval for the protected-path changes.

Low

[API-contract-violation] .github/workflows/notify-agent-sync.yml — The PR body's Prerequisites checklist references a variable named SYNC_APP_ID, but the workflow code (line 31) and its header comment (line 9) both use SYNC_CLIENT_ID. While the committed code is internally consistent, the PR body discrepancy could cause setup confusion if an operator follows the PR description rather than the workflow file's own setup instructions.
Remediation: Update the PR body's Prerequisites section to reference SYNC_CLIENT_ID instead of SYNC_APP_ID.

Next steps:

/fs-fix — agent addresses review findings automatically
/fs-fix <your instruction> — agent fixes with your specific guidance
Push commits directly — review re-runs automatically on push
/fs-fix-stop — disable automatic fix runs for this PR

Previous run (7)

Review

Findings

High

[protected-path] .github/workflows/notify-agent-sync.yml, AGENTS.md — This PR modifies files under protected paths (.github/, AGENTS.md). The PR has no linked issue in this repository to authorize changes to governance and infrastructure files. Protected-path changes always require human approval regardless of context. Affected files: .github/workflows/notify-agent-sync.yml (added), AGENTS.md (modified).

Low

[API contract violation] .github/workflows/notify-agent-sync.yml:30 — The app-id input to actions/create-github-app-token@v3.2.0 (pinned by SHA bcd2ba49) was deprecated in v3.1.0 in favor of client-id. Every run will emit a deprecation warning. The token still mints correctly today, but app-id will eventually be removed. The client-id input expects the App's Client ID (Iv23...-style string), not the numeric App ID currently stored in SYNC_APP_ID.
Remediation: Rename app-id to client-id and update the repository variable to store the App's Client ID instead of the numeric App ID.

Info

[permission-expansion] .github/workflows/notify-agent-sync.yml:34 — New workflow introduces cross-repo write access: a GitHub App token scoped to fullsend-ai/.fullsend with contents: write permission. The scope is tightly constrained (single repo, single permission, post-merge only). This is the minimum permission needed for the dispatches API.
[provenance-warning] — Prior review context discarded: provenance validation failed (unverifiable-wrong-app). This review treats all findings as first-time assessments.

Next steps:

/fs-fix — agent addresses review findings automatically
/fs-fix <your instruction> — agent fixes with your specific guidance
Push commits directly — review re-runs automatically on push
/fs-fix-stop — disable automatic fix runs for this PR

Previous run (8)

Review

Findings

High

[protected-path] .github/workflows/notify-agent-sync.yml, AGENTS.md — This PR modifies files under protected paths (.github/ and AGENTS.md). The PR has no linked issue in this repository. Human approval is required for changes to governance and infrastructure files.
Remediation: Obtain human reviewer approval for the protected-path changes.

Low

[cross-repo-contract-verifiability] .github/workflows/notify-agent-sync.yml:34 — This workflow establishes a new cross-repo contract with fullsend-ai/.fullsend by dispatching event_type=agents-updated with client_payload.sha. The consumer side cannot be verified from this repository. A mismatch would cause the consumer workflow to silently not trigger.
Remediation: Add a comment in the workflow specifying the exact contract: event_type value, client_payload schema, and a reference to the consumer workflow file path in fullsend-ai/.fullsend.
[backward-compatibility] .github/workflows/notify-agent-sync.yml:34 — Once merged, event_type=agents-updated and client_payload.sha become a committed cross-repo contract. Future changes to these values will require coordinated updates in both repos.

Next steps:

/fs-fix — agent addresses review findings automatically
/fs-fix <your instruction> — agent fixes with your specific guidance
Push commits directly — review re-runs automatically on push
/fs-fix-stop — disable automatic fix runs for this PR

Previous run (9)

Review

Findings

High

[protected-path] .github/workflows/notify-agent-sync.yml, AGENTS.md — Both changed files fall under protected paths (.github/ and AGENTS.md). The PR has no linked issue to justify modification of governance/infrastructure files. Human approval is required for all protected-path changes regardless of context.
Remediation: Link an authorizing issue or obtain explicit human approval for these protected-path changes.

Medium

[docs-currency] README.md:92 — The Workflows table in README.md (lines 88–92) enumerates all .github/workflows/ files but does not include the new notify-agent-sync.yml workflow added in this PR. The table lists fullsend.yaml, release.yml, and script-test.yml — the new workflow is missing.
Remediation: Add a row to the Workflows table for notify-agent-sync.yml.

Low

[missing-authorization] — No issue is linked to this PR. The PR body references fullsend-ai/.fullsend#174 as the coordinating change, but non-trivial changes should ideally have an authorizing issue defining scope.
Remediation: Optionally link an authorizing issue or reference fullsend-ai/.fullsend#174 more formally.

Next steps:

/fs-fix — agent addresses review findings automatically
/fs-fix <your instruction> — agent fixes with your specific guidance
Push commits directly — review re-runs automatically on push
/fs-fix-stop — disable automatic fix runs for this PR

Previous run (10)

Review

Findings

High

[protected-path] .github/workflows/notify-agent-sync.yml, AGENTS.md — Both changed files fall under protected paths (.github/, AGENTS.md). The PR has no linked issue in this repository to authorize changes to governance and infrastructure files. The PR body references fullsend-ai/.fullsend#174 on the receiving side but lacks a tracking issue in fullsend-ai/agents. Human approval is always required for protected-path changes.
Remediation: Obtain human reviewer approval for these protected-path changes.

Low

[injection] .github/workflows/notify-agent-sync.yml:34 — github.sha is interpolated directly into the run script via ${{ }} expression syntax. While github.sha is a constrained hex string with no practical injection risk, the repo's established pattern (e.g., release.yml uses ${GITHUB_SHA}) favors environment variables over expression interpolation in run blocks.
[timeout-convention] .github/workflows/notify-agent-sync.yml:16 — The notify job does not set timeout-minutes. Other lightweight jobs in this repo set explicit short timeouts (vouch-check: 5 min, functional-tests rollup: 1 min) to avoid the default 360-minute hang window.

Next steps:

/fs-fix — agent addresses review findings automatically
/fs-fix <your instruction> — agent fixes with your specific guidance
Push commits directly — review re-runs automatically on push
/fs-fix-stop — disable automatic fix runs for this PR

Previous run (11)

Review

Findings

High

[protected-path] .github/workflows/notify-agent-sync.yml — This PR modifies files under the protected path .github/. The PR has no linked issue justifying changes to governance/infrastructure files. Protected-path changes always require human approval.
Remediation: Link an authorizing issue to this PR, or obtain explicit human approval for the protected-path change.

Low

[error handling] .github/workflows/notify-agent-sync.yml:20 — If the repository variable SYNC_APP_ID or secret SYNC_PRIVATE_KEY is not configured, every push to main will produce a failing workflow run. The create-github-app-token action will error with a non-obvious message. Since these are documented prerequisites, this is expected behavior, but there is no continue-on-error or conditional check to degrade gracefully.
[process] .github/workflows/notify-agent-sync.yml:1 — This PR has no linked issue. It introduces a new cross-repo dispatch workflow (34 new lines) that creates a dependency between this repo and fullsend-ai/.fullsend. While not required by AGENTS.md, linking an authorizing issue would help document the rationale for introducing new infrastructure plumbing.
[undocumented-architectural-dependency] .github/workflows/notify-agent-sync.yml:32 — AGENTS.md section 6 documents two workflows (fullsend.yaml and release.yml) and the repo's relationship with fullsend-ai/fullsend. This PR introduces a third workflow that dispatches to a different repo (fullsend-ai/.fullsend), but AGENTS.md is not updated to reflect this new cross-repo sync mechanism.
Remediation: Add a brief entry in AGENTS.md section 6 describing notify-agent-sync.yml and its role in propagating agent digests.

Next steps:

/fs-fix — agent addresses review findings automatically
/fs-fix <your instruction> — agent fixes with your specific guidance
Push commits directly — review re-runs automatically on push
/fs-fix-stop — disable automatic fix runs for this PR

Previous run (12)

Review

Findings

High

[protected-path] .github/workflows/notify-agent-sync.yml — This PR adds a file under .github/, which is a protected path requiring human approval. No issue is linked to justify modification of governance/infrastructure files. Human review is required regardless of automated review findings.
Remediation: Link an issue authorizing the workflow addition, or obtain explicit human approval for the protected-path change.

Medium

[scope-documentation] AGENTS.md:68 — The Workflows section (lines 68–74) enumerates the repo's CI workflows but does not mention the newly added notify-agent-sync.yml. Since AGENTS.md is the single source of truth for agent-facing guidance, this inventory will be incomplete after merge.
Remediation: Add a bullet documenting notify-agent-sync.yml — trigger (push to main), purpose (dispatches agents-updated to .fullsend for digest sync), and ownership.

Low

[error-handling] .github/workflows/notify-agent-sync.yml:27 — The run: block does not include set -euo pipefail, unlike other workflow steps in this repo (e.g., release.yml). Currently only a single command, so the default set -e suffices, but adding pipefail would match the established convention.
[naming-conventions] .github/workflows/notify-agent-sync.yml:16 — The version comment on the pinned action uses major-only format (# v3) while every other pinned action in the repo uses full semver (# vMAJOR.MINOR.PATCH).
[missing-authorization] .github/workflows/notify-agent-sync.yml — No issue is linked to this PR. The PR body references an upstream PR (Replace renovate agent digest tracking with sync workflow .fullsend#174) providing traceability, but non-trivial changes conventionally trace to a local issue.

Next steps:

/fs-fix — agent addresses review findings automatically
/fs-fix <your instruction> — agent fixes with your specific guidance
Push commits directly — review re-runs automatically on push
/fs-fix-stop — disable automatic fix runs for this PR

fullsend-ai-review · 2026-08-19T13:54:05Z

🤖 Finished Review · ✅ Success · Started 1:54 PM UTC · Completed 2:05 PM UTC

Commit: f9dba0d · View workflow run →

fullsend-ai-review · 2026-08-19T14:11:56Z

🤖 Finished Review · ✅ Success · Started 2:11 PM UTC · Completed 2:26 PM UTC

Commit: a8c781d · View workflow run →

fullsend-ai-review · 2026-08-19T14:30:21Z

🤖 Finished Review · ✅ Success · Started 2:30 PM UTC · Completed 2:56 PM UTC

Commit: c54da96 · View workflow run →

waynesun09

Review-only sweep: 2 findings on the new dispatch workflow (1 critical, 1 medium). Details inline.

fullsend-ai-review · 2026-08-19T15:06:07Z

🤖 Finished Review · ✅ Success · Started 3:06 PM UTC · Completed 3:21 PM UTC

Commit: ed81479 · View workflow run →

fullsend-ai-review · 2026-08-19T15:23:29Z

🤖 Review · ⚠️ Cancelled · Started 3:23 PM UTC · Ended 3:24 PM UTC

Commit: 673ccab · View workflow run →

fullsend-ai-review · 2026-08-19T15:26:24Z

🤖 Finished Review · ✅ Success · Started 3:26 PM UTC · Completed 3:41 PM UTC

Commit: f51124f · View workflow run →

fullsend-ai-review · 2026-08-19T15:45:52Z

🤖 Finished Review · ✅ Success · Started 3:45 PM UTC · Completed 4:01 PM UTC

Commit: 71dafb9 · View workflow run →

fullsend-ai-review · 2026-08-19T16:13:14Z

🤖 Finished Review · ✅ Success · Started 4:13 PM UTC · Completed 4:29 PM UTC

Commit: bf9409c · View workflow run →

fullsend-ai-review · 2026-08-19T16:47:04Z

🤖 Finished Review · ✅ Success · Started 4:47 PM UTC · Completed 5:06 PM UTC

Commit: bae2199 · View workflow run →

fullsend-ai-review · 2026-08-19T17:12:49Z

🤖 Finished Review · ✅ Success · Started 5:12 PM UTC · Completed 5:40 PM UTC

Commit: 77d9740 · View workflow run →

waynesun09

Review-only sweep: 3 findings on the dispatch workflow (all medium). Details inline.

fullsend-ai-review · 2026-08-19T17:47:52Z

🤖 Finished Review · ✅ Success · Started 5:47 PM UTC · Completed 6:00 PM UTC

Commit: 27c0d64 · View workflow run →

fullsend-ai-review · 2026-08-19T18:05:27Z

🤖 Finished Review · ✅ Success · Started 6:05 PM UTC · Completed 6:24 PM UTC

Commit: c9524ef · View workflow run →

waynesun09

Review-only sweep (round 3): 3 MEDIUM findings on the dispatch workflow. Details inline.

Add notify-agent-sync.yml that fires a repository_dispatch event to fullsend-ai/.fullsend on every push to main, triggering cross-repo agent digest sync via sync-agent-digests.yml. Signed-off-by: Claude Opus 4.6 <noreply@anthropic.com> Signed-off-by: Greg Allen <gallen@redhat.com>

ggallen · 2026-08-19T22:33:38Z

Code Review -- Round 2: APPROVED

Verified:

Pinned SHA bcd2ba49218906704ab6c1aa796996da409d3eb1 is the v3.2.0 release commit of actions/create-github-app-token. Both client-id and permission-contents inputs confirmed present in the action at this SHA.
Consumer workflow sync-agent-digests.yml exists in fullsend-ai/.fullsend and listens for repository_dispatch type agents-updated -- contract matches.
paths-ignore: '.fullsend/**' and actor guard != 'fullsend-ai-sync[bot]' provide dual loop prevention.
permissions: {} everywhere; app token scoped to repositories: .fullsend with permission-contents: write only.
Slack failure notification handles missing webhook gracefully (::warning:: + exit 0).
AGENTS.md and README.md updates are consistent with the workflow.

INFO (non-blocking): No workflow_dispatch trigger on the producer side -- manual re-dispatch is only possible from the consumer (sync-agent-digests.yml). Fine since the consumer already has it, but adding workflow_dispatch: {} here would help ops.

fullsend-ai-review · 2026-08-19T23:10:04Z

🤖 Finished Review · ✅ Success · Started 11:10 PM UTC · Completed 11:26 PM UTC

Commit: 156f122 · View workflow run →

fullsend-ai-review

See the review comment for full details.

fullsend-ai-retro · 2026-08-20T00:22:28Z

🤖 Finished Retro · ❌ Failure · Started 12:22 AM UTC · Completed 12:22 AM UTC

Commit: 156f122 · View workflow run →

ggallen requested a review from a team as a code owner August 19, 2026 13:26

qodo-code-review Bot reviewed Aug 19, 2026

View reviewed changes

Comment thread .github/workflows/notify-agent-sync.yml Outdated

Comment thread .github/workflows/notify-agent-sync.yml Outdated

Comment thread .github/workflows/notify-agent-sync.yml Outdated

Comment thread .github/workflows/notify-agent-sync.yml