fix(scaffold): use __FULLSEND_AI_REF__ for mint-token action refs

[waynesun09]

Summary

• Replace hardcoded @v0 with @__FULLSEND_AI_REF__ for mint-token composite action in prioritize-scheduler.yml and repo-maintenance.yml scaffold templates
• Matches the pattern already used by reusable workflow uses: refs (from feat(scaffold): pin workflow refs to release commit SHA #2615)

Without this, downstream .fullsend repos that enable sha_pinning_required reject mint-token@v0 as an unpinned action ref. Confirmed by triggering prioritize-scheduler on fullsend-ai/.fullsend after enabling the policy — run 28122373431 failed with:

The action fullsend-ai/fullsend/.github/actions/mint-token@v0 is not allowed in fullsend-ai/.fullsend because all actions must be pinned to a full-length commit SHA.

Test plan

• After merge + release + scaffold sync, trigger prioritize-scheduler on fullsend-ai/.fullsend and confirm it passes
• Verify repo-maintenance also passes

[qodo-code-review]

PR Summary by Qodo

Fix scaffold workflows to pin mint-token action via FULLSEND_AI_REF
🐞 Bug fix ⚙️ Configuration changes 🕐 Less than 10 minutes

Description

• Replace mint-token action ref @v0 with @__FULLSEND_AI_REF__ in scaffolded workflows.
• Ensure scaffolded downstream repos pass sha_pinning_required GitHub Actions policy.
• Align action pinning behavior with existing reusable workflow uses: ref pattern.

Diagram

graph TD
  A["prioritize-scheduler.yml (template)"] --> C["mint-token@__FULLSEND_AI_REF__"] --> D["Scaffold sync"] --> E["Downstream workflows"] --> F{"SHA pinned?"} --> G["Job allowed"]
  B["repo-maintenance.yml (template)"] --> C

Loading

High-Level Assessment

The following are alternative approaches to this PR:

1. Hard-pin a specific commit SHA in templates

• ➕ Immediately satisfies sha_pinning_required without needing placeholder substitution
• ➖ Requires frequent manual updates when the action changes
• ➖ Scaffolded repos may drift to stale SHAs if not resynced

2. Vendor mint-token action into the scaffolded repo (local action)

• ➕ Eliminates external action ref pinning concerns
• ➕ Downstream runs become independent of upstream ref policy changes
• ➖ Duplicates action code across repos and increases maintenance burden
• ➖ Harder to roll out fixes consistently without additional automation

Recommendation: Keep the current approach: using __FULLSEND_AI_REF__ maintains a single source of truth while still meeting SHA pinning requirements via scaffold-time substitution. It also matches the existing pattern used for reusable workflow refs, reducing cognitive overhead and avoiding the maintenance costs of vendoring or manual SHA updates.

Files changed (2) +2 / -2

Bug fix (2) +2 / -2

prioritize-scheduler.ymlPin mint-token action ref via __FULLSEND_AI_REF__ placeholder +1/-1

Pin mint-token action ref via FULLSEND_AI_REF placeholder

• Switches the mint-token composite action reference from '@v0' to '@__FULLSEND_AI_REF__' so scaffold sync can replace it with a full commit SHA. Prevents downstream failures when 'sha_pinning_required' is enabled.

internal/scaffold/fullsend-repo/.github/workflows/prioritize-scheduler.yml

repo-maintenance.ymlPin mint-token action ref via __FULLSEND_AI_REF__ placeholder +1/-1

Pin mint-token action ref via FULLSEND_AI_REF placeholder

• Updates the mint-token composite action reference to use the scaffold-time '__FULLSEND_AI_REF__' placeholder instead of '@v0'. Ensures repo-maintenance scaffolds comply with action SHA pinning policies.

internal/scaffold/fullsend-repo/.github/workflows/repo-maintenance.yml

[github-actions]

Site preview

Preview: https://89e504e3-site.fullsend-ai.workers.dev

Commit: 9111c9cd2bc6859d4ef3613c91ccc10fd0c78a2f

[qodo-code-review]

Code Review by Qodo

🐞 Bugs (0) 📘 Rule violations (0) 📜 Skill insights (0)

Context used

✅ Compliance rules (platform): 58 rules

✅ Skills: writing-user-docs, writing-adrs

1. Scaffold tests expect @v0 ✓ Resolved 🐞 Bug ☼ Reliability

Description

internal/scaffold/scaffold_test.go still asserts that the embedded workflow templates contain
fullsend-ai/fullsend/.github/actions/mint-token@v0, but this PR changes those templates to
@__FULLSEND_AI_REF__. This will cause CI/test failures even though the template change is correct.

Code

internal/scaffold/fullsend-repo/.github/workflows/prioritize-scheduler.yml[38]

+        uses: fullsend-ai/fullsend/.github/actions/mint-token@__FULLSEND_AI_REF__

Relevance

⭐⭐⭐ High

Team often updates scaffold_test.go alongside scaffold template changes to prevent CI regressions
(e.g., PRs #1457, #1074).

PR-#1457
PR-#1074

ⓘ Recommendations generated based on similar findings in past PRs

Evidence

The modified workflow templates now use mint-token@__FULLSEND_AI_REF__, while the scaffold tests
still search for mint-token@v0 in those same template files, so the assertions will fail after
this PR.

internal/scaffold/fullsend-repo/.github/workflows/prioritize-scheduler.yml[36-42]
internal/scaffold/fullsend-repo/.github/workflows/repo-maintenance.yml[67-74]
internal/scaffold/scaffold_test.go[712-807]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

### Issue description
Scaffold tests are asserting the old hardcoded action ref (`mint-token@v0`) in the raw embedded workflow templates, but the templates were updated to use the render-time placeholder (`mint-token@__FULLSEND_AI_REF__`). This mismatch will fail tests.

### Issue Context
The templates under `internal/scaffold/fullsend-repo/.github/workflows/` are embedded and read directly by `FullsendRepoFile(...)` in `internal/scaffold/scaffold_test.go`, so those assertions must match the raw template text (not the rendered output).

### Fix Focus Areas
- internal/scaffold/scaffold_test.go[712-807]

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

---

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 7:01 PM UTC · Completed 7:09 PM UTC
Commit: f051dbd · View workflow run →

[fullsend-ai-review]

Looks good to me

Previous run

Review

Findings

High

• [test integrity] internal/scaffold/scaffold_test.go:721 — TestRepoMaintenanceWorkflowContent asserts that the raw template contains mint-token@v0, but this PR changes the template to use mint-token@__FULLSEND_AI_REF__. FullsendRepoFile reads the raw embedded template via content.ReadFile (no rendering/substitution), so this assertion will fail after the change.
  Remediation: Change line 721 to assert.Contains(t, s, "fullsend-ai/fullsend/.github/actions/mint-token@__FULLSEND_AI_REF__").

• [test integrity] internal/scaffold/scaffold_test.go:802 — TestPrioritizeSchedulerWorkflowContent asserts that the raw template contains mint-token@v0, but this PR changes the template to use mint-token@__FULLSEND_AI_REF__. Same root cause — FullsendRepoFile reads the unrendered template, so this assertion will fail.
  Remediation: Change line 802 to assert.Contains(t, s, "fullsend-ai/fullsend/.github/actions/mint-token@__FULLSEND_AI_REF__").

---

Labels: PR modifies scaffold workflow templates under internal/scaffold/

[fullsend-ai-review]

See the review comment for full details.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 9:21 PM UTC · Completed 9:30 PM UTC
Commit: 9111c9c · View workflow run →

[fullsend-ai-retro]

🤖 Finished Retro · ✅ Success · Started 9:46 PM UTC · Completed 9:50 PM UTC
Commit: 9111c9c · View workflow run →

[fullsend-ai-retro]

Retro: PR #2628 — fix(scaffold): use __FULLSEND_AI_REF__ for mint-token action refs

Workflow went well. This was a small human-authored PR (4 lines changed across 3 files) that replaced hardcoded @v0 refs with @__FULLSEND_AI_REF__ placeholders in scaffold workflow templates.

Timeline

1. 18:58 UTC — waynesun09 opened the PR with template changes but without updating corresponding test assertions.
2. 19:01–19:09 UTC — Both qodo-code-review[bot] and fullsend-ai-review[bot] independently identified that scaffold_test.go still asserted @v0 at lines 721 and 802. The review agent requested changes with two high-severity [test integrity] findings, each including the exact line number and remediation code.
3. 19:31 UTC — ralphbean approved the approach.
4. 21:17 UTC — waynesun09 pushed a second commit updating the test assertions.
5. 21:30 UTC — Review bot approved on re-review.
6. 21:42 UTC — PR merged.

Assessment

• Review quality: Strong. The review agent caught a real issue the author missed, provided actionable remediation with exact code, and correctly approved after the fix. This is textbook good review behavior.
• Rework rate: 1 iteration. Expected for a human PR where tests were overlooked in the initial commit.
• Token cost: Reasonable. Two review runs (one per push) is the minimum for a change-request cycle.
• Autonomy readiness: The review agent's test-integrity detection is mature for this class of change (template edits with corresponding test assertions). No gaps between agent and human review were observed — ralphbean's approval aligned with the agent's assessment after the fix.

Existing open issues #2566 and #1748 already cover the general review capabilities demonstrated here. No new proposals needed.