reusable-code.yml

# Reusable code agent workflow. Called by thin callers in .fullsend repos
# via workflow_call. Runs in the caller's repo context (secrets, checkout).
#
# Concurrency: agent-scoped cancel-in-progress group (distinct from dispatch/thin
# caller groups so workflow_call parent runs are not cancelled).
name: Code Agent

on:
  workflow_call:
    inputs:
      event_type:
        required: true
        type: string
      source_repo:
        required: true
        type: string
      event_payload:
        required: true
        type: string
      mint_url:
        required: true
        type: string
      gcp_region:
        required: true
        type: string
      fullsend_version:
        required: false
        type: string
        default: ""
      install_mode:
        required: false
        type: string
        default: "per-org"
      fullsend_ai_ref:
        description: "Deprecated: upstream defaults now use job.workflow_sha. Kept for per-org caller compatibility."
        type: string
        required: false
        default: v0
      runner_image:
        description: GitHub Actions runner image for agent jobs.
        type: string
        required: false
        default: "ubuntu-24.04"
    secrets:
      FULLSEND_GCP_WIF_PROVIDER:
        required: true
      FULLSEND_GCP_PROJECT_ID:
        required: true
      OTEL_EXPORTER_OTLP_TRACES_HEADERS:
        required: false
      OTEL_EXPORTER_OTLP_HEADERS:
        required: false

concurrency:
  group: fullsend-code-agent-${{ inputs.source_repo }}-${{ fromJSON(inputs.event_payload).issue.number || fromJSON(inputs.event_payload).pull_request.number }}
  cancel-in-progress: true

jobs:
  code:
    name: Code
    runs-on: ${{ inputs.runner_image }}
    permissions:
      actions: write
      contents: write
      id-token: write
      issues: write
      packages: read
      pull-requests: write

    steps:
      - name: Checkout config repository
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          # checkout@v7 blocks fork PR checkouts on pull_request_target by default.
          # Safe here: only .fullsend/ config is read, no fork code is executed,
          # and credentials are not persisted.
          ref: ${{ github.event_name == 'pull_request_target' && github.event.pull_request.base.sha || github.sha }}
          persist-credentials: false
          allow-unsafe-pr-checkout: ${{ github.event_name == 'pull_request_target' }}

      - name: Checkout upstream defaults
        # Keep in sync with --vendor marker paths (see internal/scaffold/vendorcontent.go VendoredMarkerPath).
        if: hashFiles('.defaults/action.yml', '.fullsend/.defaults/action.yml') == ''
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          repository: ${{ job.workflow_repository }}
          ref: ${{ job.workflow_sha }}
          path: .defaults
          fetch-depth: 1
          sparse-checkout: |
            .github/actions/
            .github/scripts/
            internal/scaffold/fullsend-repo/
            action.yml

      - name: Prepare workspace (upstream defaults + org/repo overrides)
        env:
          INSTALL_MODE: ${{ inputs.install_mode }}
        run: |
          set -euo pipefail
          if [[ "${INSTALL_MODE}" != "per-org" && "${INSTALL_MODE}" != "per-repo" ]]; then
            printf 'Received install_mode: %q\n' "${INSTALL_MODE}"
            echo "::error::Invalid install_mode: must be 'per-org' or 'per-repo'"
            exit 1
          fi
          SRC=".defaults/internal/scaffold/fullsend-repo"
          LAYERED_DIRS="agents skills schemas harness plugins policies providers scripts env"
          DEST=""
          if [[ "${INSTALL_MODE}" == "per-repo" ]]; then
            DEST=".fullsend/"
          fi
          for dir in ${LAYERED_DIRS}; do
            if [[ -d "${SRC}/${dir}" ]]; then
              mkdir -p "${DEST}${dir}"
              cp -r "${SRC}/${dir}/." "${DEST}${dir}/"
            fi
          done
          mkdir -p .github/scripts
          cp "${SRC}/.github/scripts/setup-agent-env.sh" .github/scripts/setup-agent-env.sh


      - name: Validate enrollment and extract repo metadata
        id: repo-parts
        uses: ./.defaults/.github/actions/validate-enrollment
        with:
          source_repo: ${{ inputs.source_repo }}
          install_mode: ${{ inputs.install_mode }}

      - name: Mint coder token
        id: app-token
        uses: ./.defaults/.github/actions/mint-token
        with:
          role: coder
          repos: ${{ steps.repo-parts.outputs.name }}
          mint_url: ${{ inputs.mint_url }}

      - name: Checkout target repository
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          repository: ${{ inputs.source_repo }}
          token: ${{ steps.app-token.outputs.token }}
          path: target-repo
          fetch-depth: 0
          persist-credentials: false

      - name: Setup GCP and prepare credentials
        uses: ./.defaults/.github/actions/setup-gcp
        with:
          gcp_wif_provider: ${{ secrets.FULLSEND_GCP_WIF_PROVIDER }}
          gcp_project_id: ${{ secrets.FULLSEND_GCP_PROJECT_ID }}
          fullsend-dir: ${{ inputs.install_mode == 'per-repo' && '.fullsend' || '' }}

      - name: Resolve bot identity
        env:
          GH_TOKEN: ${{ steps.app-token.outputs.token }}
        run: |
          set -euo pipefail
          read -r BOT_LOGIN BOT_USER_ID < <(
            gh api graphql -f query='{ viewer { login databaseId } }' \
              | jq -r '.data.viewer | "\(.login) \(.databaseId)"'
          )
          GIT_BOT_EMAIL="${BOT_USER_ID}+${BOT_LOGIN}@users.noreply.github.com"
          echo "Resolved bot identity: ${BOT_LOGIN} (${BOT_USER_ID})"
          echo "GIT_BOT_EMAIL=${GIT_BOT_EMAIL}" >> "${GITHUB_ENV}"
          git config --global user.email "${GIT_BOT_EMAIL}"
          git config --global user.name "${BOT_LOGIN}"

      - name: Setup agent environment
        env:
          AGENT_PREFIX: CODE_
          CODE_TARGET_REPO_DIR: target-repo
          CODE_ANTHROPIC_VERTEX_PROJECT_ID: ${{ secrets.FULLSEND_GCP_PROJECT_ID }}
          CODE_CLOUD_ML_REGION: ${{ inputs.gcp_region }}
          CODE_ISSUE_NUMBER: ${{ fromJSON(inputs.event_payload).issue.number }}
          # Per-run runtime/model/effort overrides from repository variables
          # (FULLSEND_MODEL, CODE_FULLSEND_MODEL, ...); see docs/runtimes.md.
          FULLSEND_REPO_VARS: ${{ toJSON(vars) }}
        run: bash .github/scripts/setup-agent-env.sh

      - name: Run code agent
        uses: ./.defaults/
        env:
          GITHUB_ISSUE_URL: ${{ fromJSON(inputs.event_payload).issue.html_url }}
          FULLSEND_WORK_ITEM_URL: ${{ fromJSON(inputs.event_payload).issue.html_url }}
          FULLSEND_WORK_ITEM_KEY: ${{ fromJSON(inputs.event_payload).issue.number }}
          ISSUE_NUMBER: ${{ fromJSON(inputs.event_payload).issue.number }}
          # Reaches the harness pre-script inside fullsend run, which reads it
          # for its --force override of the existing-PR check (pre-script
          # output protocol, issue #4718). The override is not end-to-end:
          # the dispatcher's own "Check for existing PRs" step gates
          # stage=code first and does not honor --force, so a /fs-code
          # --force comment is stopped before this value is ever read.
          # env-quoted, never interpolated into run: blocks.
          COMMENT_BODY: ${{ fromJSON(inputs.event_payload).comment.body }}
          REPO_FULL_NAME: ${{ inputs.source_repo }}
          CODE_ALLOWED_TARGET_BRANCHES: ''
          TARGET_BRANCH: main
          OTEL_EXPORTER_OTLP_ENDPOINT: ${{ vars.OTEL_EXPORTER_OTLP_ENDPOINT }}
          OTEL_EXPORTER_OTLP_TRACES_ENDPOINT: ${{ vars.OTEL_EXPORTER_OTLP_TRACES_ENDPOINT }}
          OTEL_EXPORTER_OTLP_TRACES_HEADERS: ${{ secrets.OTEL_EXPORTER_OTLP_TRACES_HEADERS }}
          OTEL_EXPORTER_OTLP_HEADERS: ${{ secrets.OTEL_EXPORTER_OTLP_HEADERS }}
          OTEL_EXPORTER_OTLP_CERTIFICATE: ${{ vars.OTEL_EXPORTER_OTLP_CERTIFICATE }}
          OTEL_RESOURCE_ATTRIBUTES: ${{ vars.OTEL_RESOURCE_ATTRIBUTES }}
          OTEL_SDK_DISABLED: ${{ vars.OTEL_SDK_DISABLED }}
          OTEL_INSTRUMENTATION_GENAI_CAPTURE_MESSAGE_CONTENT: ${{ vars.OTEL_INSTRUMENTATION_GENAI_CAPTURE_MESSAGE_CONTENT }}
          # OpenAI Workload Identity Federation for the pi runtime (ADR 0092):
          # non-secret identifiers the runner exchanges the job's OIDC token
          # against. Unset = the openai provider is not usable in this repo.
          FULLSEND_OPENAI_AUDIENCE: ${{ vars.FULLSEND_OPENAI_AUDIENCE }}
          FULLSEND_OPENAI_IDENTITY_PROVIDER_ID: ${{ vars.FULLSEND_OPENAI_IDENTITY_PROVIDER_ID }}
          FULLSEND_OPENAI_SERVICE_ACCOUNT_ID: ${{ vars.FULLSEND_OPENAI_SERVICE_ACCOUNT_ID }}
        with:
          agent: code
          version: ${{ inputs.fullsend_version || job.workflow_sha }}
          fullsend-dir: ${{ inputs.install_mode == 'per-repo' && '.fullsend' || '' }}
          run-url: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
          status-repo: ${{ inputs.source_repo }}
          status-number: ${{ fromJSON(inputs.event_payload).issue.number }}
          status-comment-id: ${{ fromJSON(inputs.event_payload).comment.id }}
          mint-url: ${{ inputs.mint_url }}