chore: update fullsend per-repo installation - #943
Closed
ggallen wants to merge 1 commit into
Closed
Conversation
PR Summary by QodoPin fullsend per-repo workflows and add prioritize scaffold
AI Description
Diagram
High-Level Assessment
Files changed (3)
|
Member
Author
|
Closing — will re-install after #6490 lands with project_number passthrough. |
Code Review by Qodo
1. Missing Projects permission
|
![qodo-code-review[bot]](https://avatars.githubusercontent.com/in/484649?s=60&v=4){kind=small}
Comment on lines
+1
to
+2
| # This file is managed by fullsend. Do not edit it directly. | ||
| # Upstream: https://github.com/fullsend-ai/fullsend/blob/main/internal/scaffold/fullsend-repo/.github/workflows/prioritize.yml |
There was a problem hiding this comment.
1. Protected paths modified without issue 📜 Skill insight § Compliance
This PR modifies protected governance/infrastructure paths under .github/ and .fullsend/ but the PR description does not link an authorizing issue/ADR for these changes. Protected-path changes require explicit authorization and must not be auto-approved.
Agent Prompt
## Issue description
The PR modifies protected governance/infrastructure paths (e.g., `.github/workflows/*`, `.fullsend/*`) without an explicit linked issue/ADR authorizing the change, which violates the protected-path review requirement.
## Issue Context
Protected-path changes require explicit authorization and manual review; the PR should reference the authorizing issue/ADR in the PR description (preferred) and/or in-file comments where applicable.
## Fix Focus Areas
- .github/workflows/prioritize.yml[1-4]
- .fullsend/config.yaml[1-21]
- .github/workflows/fullsend.yaml[45-55]
ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools
Comment on lines
+7
to
+11
| permissions: | ||
| actions: write | ||
| contents: read | ||
| id-token: write | ||
| issues: write |
There was a problem hiding this comment.
2. Unjustified workflow write permissions 📜 Skill insight ⛨ Security
The new workflow grants broad write permissions (e.g., actions: write, id-token: write, `issues: write`) without explicit least-privilege justification. Overbroad workflow token permissions increase blast radius if the workflow is abused or misconfigured.
Agent Prompt
## Issue description
The new workflow declares elevated GitHub Actions token permissions without explicit least-privilege justification.
## Issue Context
Permission expansions in workflow manifests must follow least privilege and include an explicit authorization/justification (linked issue/ADR) for any expanded capability.
## Fix Focus Areas
- .github/workflows/prioritize.yml[7-12]
ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools
Comment on lines
+7
to
+12
| permissions: | ||
| actions: write | ||
| contents: read | ||
| id-token: write | ||
| issues: write | ||
|
|
There was a problem hiding this comment.
3. Missing projects permission 🐞 Bug ⛨ Security
.github/workflows/prioritize.yml does not grant projects: write, but the prioritize post-script uses GitHub Projects V2 GraphQL APIs; with the default GITHUB_TOKEN this will 403 and can fail the workflow when ORG/PROJECT_NUMBER are set. This prevents the prioritize agent from updating project-board RICE fields as designed.
Agent Prompt
### Issue description
The prioritize workflow’s token lacks `projects: write`, but the prioritize post-script calls Projects V2 GraphQL operations (view project, list fields, update item field values). Without the permission, these calls will fail with 403 using the default `GITHUB_TOKEN`.
### Issue Context
The harness/scripts expect the GitHub token to have both issues write and project write capability for project-board updates.
### Fix Focus Areas
- .github/workflows/prioritize.yml[7-12]
ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools
Comment on lines
-15
to
-16
| agents: | ||
| - source: https://raw.githubusercontent.com/redhat-community-ai-tools/qualityflow-fullsend/f6311b4f30ee5c23c597dba07bccc8ac0aa991be/harness/qualityflow.yaml#sha256=c0a51b2f75172aebd577fd38c8012a7c566a84f84812ebd9aa4cc07ad3b2220e |
There was a problem hiding this comment.
4. Config/docs schema mismatch 🐞 Bug ⚙ Maintainability
.fullsend/config.yaml no longer declares an agents: list, but the repository documentation instructs users to register per-repo harness overrides via .fullsend/config.yaml under agents:. This inconsistency makes per-repo customization unclear and can break consumers that still expect agents configuration.
Agent Prompt
### Issue description
The scaffolded `.fullsend/config.yaml` removed the `agents:` section, but docs still describe configuring per-repo harness overrides by adding entries to `.fullsend/config.yaml.agents`. This creates conflicting guidance and increases the chance that per-repo installs are misconfigured.
### Issue Context
Either the docs need updating to the new roles-based config schema, or `.fullsend/config.yaml` should retain (or reintroduce) the documented `agents:` structure.
### Fix Focus Areas
- .fullsend/config.yaml[7-13]
- docs/code.md[142-150]
ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools
Comment on lines
+26
to
+28
| concurrency: | ||
| group: fullsend-prioritize-${{ inputs.source_repo }}-${{ fromJSON(inputs.event_payload).issue.number }} | ||
| cancel-in-progress: true |
There was a problem hiding this comment.
5. Concurrency json parse fragile 🐞 Bug ☼ Reliability
prioritize.yml builds its concurrency group with fromJSON(inputs.event_payload).issue.number, which hard-fails if event_payload is not valid JSON or lacks .issue.number. A malformed dispatch input will prevent the workflow from starting and/or cause unexpected concurrency collisions.
Agent Prompt
### Issue description
The concurrency group uses `fromJSON()` on a free-form workflow_dispatch input, which can throw evaluation errors if the string isn’t valid JSON or doesn’t have the expected shape.
### Issue Context
This is especially brittle for manual runs or any caller that passes a different payload shape.
### Fix Focus Areas
- .github/workflows/prioritize.yml[26-28]
ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The default branch (main) has branch protection rules that prevent direct pushes.
Merge this PR to deliver the scaffold files.