refactor(dispatch): inline stage workflows to fix version skew

[rh-hemartin]

Summary

• Inline all stage workflow jobs into reusable-dispatch.yml to fix version skew
• Resolves Implement ADR 62: inline stage workflows into reusable-dispatch.yml #2884
• Eliminates separate reusable-*.yml stage workflow files that caused version mismatches

Context

ADR #62 documents this change. Per-repo shims reference reusable-dispatch.yml@v0, which then called separate reusable stage workflows also @v0. When stages evolved but the tag didn't move, version skew caused failures. Inlining all stage jobs into reusable-dispatch.yml eliminates the second @v0 reference.

This is a refactor, not a feature — it restructures how workflows are organized without changing their runtime behavior.

Test plan

• Verify dispatch workflow still works for per-org and per-repo modes
• Check that all stage jobs execute correctly
• Confirm no regressions in existing functionality

🤖 Generated with Claude Code

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 12:30 PM UTC · Completed 12:47 PM UTC
Commit: 4f2d5c2 · View workflow run →

[qodo-code-review]

PR Summary by Qodo

Inline per-repo stage jobs into dispatch workflow to eliminate defaults version skew

🐞 Bug fix ✨ Enhancement 🧪 Tests 🕐 40+ Minutes

AI Description

• Inline per-repo stage job logic into a single dispatch workflow to prevent version skew failures.
• Add a composite action to layer upstream defaults with org/repo overrides and validate enrollment.
• Update scaffolding, vendoring, and tests to reference dispatch.yml instead of
 reusable-dispatch.yml.

Diagram

graph TD
  E(("GitHub event")) --> W["dispatch.yml"] --> R{{"Route stage"}} --> S["Stage job (triage/code/review/fix/...) "]
  S --> U["Checkout upstream defaults (.defaults)"] --> P["prepare-workspace action"] --> A["Run Fullsend agent (.defaults action)"]
  S --> T["Checkout target repo"] --> A

  subgraph Legend
    direction LR
    _evt(("Event")) ~~~ _job["Job/step"] ~~~ _dec{{"Decision"}}
  end

Loading

High-Level Assessment

The following are alternative approaches to this PR:

1. Keep stage workflows, but vendor/copy them into the install target

• ➕ Preserves modular per-stage workflow files and smaller dispatch.yml
• ➕ Avoids hardcoded @v0 by making stage workflows local to the installed repo
• ➖ More files to manage in the installed repo; harder upgrades/cleanup across repos
• ➖ Still requires path-rewriting and additional vendoring logic (similar to pre-ADR62 complexity)

2. Keep workflow_call chaining, but pin stage workflow refs to the same SHA as dispatch

• ➕ Retains reusable-workflow composition while eliminating version skew in theory
• ➖ Not feasible in GitHub Actions today: uses: refs cannot be parameterized via expressions/inputs
• ➖ Would require manual synchronized ref updates everywhere, reintroducing skew risk

3. Move shared stage logic into composite actions and keep a thin dispatch workflow

• ➕ Better reusability and testability for common setup steps
• ➕ Can reduce YAML duplication across stage jobs
• ➖ Doesn’t fully solve the historical problem if workflows still reference remote/pinned defaults inconsistently
• ➖ Requires more refactoring now; may be better as a follow-up after inlining stabilizes

Recommendation: The PR’s approach (inline stage jobs into dispatch.yml) is the most robust way to eliminate version skew given GitHub Actions’ inability to parameterize reusable-workflow refs. The added prepare-workspace composite action is a good step toward keeping the inlined jobs maintainable; further factoring of repeated setup steps into additional composite actions can be considered later without reintroducing cross-repo workflow_call ref issues.

Files changed (10) +1321 / -69

Enhancement (3) +96 / -4

action.ymlAdd composite action to layer defaults + overrides and validate enrollment +64/-0

Add composite action to layer defaults + overrides and validate enrollment

• Introduces a composite GitHub Action that copies scaffolded defaults from .defaults into the workspace, overlays org/repo customizations based on install_mode, and runs validate-enrollment to extract repo metadata. This centralizes the per-job workspace preparation needed by the newly inlined stage jobs.

.github/actions/prepare-workspace/action.yml

vendorcontent.goVendor dispatch.yml for per-repo and treat it as a reusable workflow asset +6/-1

Vendor dispatch.yml for per-repo and treat it as a reusable workflow asset

• Adjusts vendoring logic to apply the (now no-op) dispatch path rendering to dispatch.yml, and marks dispatch.yml as a vendorable workflow alongside legacy reusable-*.yml workflows.

internal/scaffold/vendorcontent.go

vendormanifest.goUpdate vendoring manifest to include dispatch.yml and prepare-workspace action +26/-3

Update vendoring manifest to include dispatch.yml and prepare-workspace action

• Expands safe-path validation to allow dispatch.yml (and legacy reusable-*.yml), adds dispatch.yml to the vendored workflow list, and includes the new prepare-workspace action in defaults infra paths. Also adds explicit legacy workflow enumeration for cleanup/migration support.

internal/scaffold/vendormanifest.go

Bug fix (1) +1160 / -0

dispatch.ymlInline all per-repo stage jobs into dispatch workflow +1160/-0

Inline all per-repo stage jobs into dispatch workflow

• Adds a reusable dispatch workflow that performs routing and executes triage/code/review/fix/retro/prioritize jobs inline, rather than calling separate reusable stage workflows. Each stage job checks out upstream defaults at job.workflow_sha, prepares the workspace, mints the appropriate token, and runs the agent, eliminating failures caused by hardcoded @v0 workflow references.

.github/workflows/dispatch.yml

Refactor (1) +6 / -6

render.goSwitch per-repo reusable dispatch reference to dispatch.yml; deprecate stage-path rewrite +6/-6

Switch per-repo reusable dispatch reference to dispatch.yml; deprecate stage-path rewrite

• Changes scaffold rendering to reference dispatch.yml (vendored and upstream) instead of reusable-dispatch.yml. Deprecates RenderDispatchPerRepoStagePaths by making it a no-op since stage workflows are no longer referenced via uses: lines in per-repo mode.

internal/scaffold/render.go

Tests (4) +53 / -51

installfiles_test.goFix per-repo installfile test to expect dispatch.yml +2/-1

Fix per-repo installfile test to expect dispatch.yml

• Updates the vendored installfiles test assertion to look for dispatch.yml instead of reusable-* references, aligning with ADR 62 behavior.

internal/scaffold/installfiles_test.go

render_test.goUpdate scaffold render tests for dispatch.yml and no-op stage rewrite +10/-7

Update scaffold render tests for dispatch.yml and no-op stage rewrite

• Updates tests to expect dispatch.yml in generated shims and upstream walking. Replaces prior path-rewrite assertions with a no-op assertion for RenderDispatchPerRepoStagePaths per ADR 62.

internal/scaffold/render_test.go

scaffold_test.goAlign shim template tests with dispatch.yml concurrency documentation +2/-2

Align shim template tests with dispatch.yml concurrency documentation

• Updates assertions verifying shim template content to reference dispatch.yml instead of reusable-dispatch.yml, keeping concurrency guidance consistent with the new design.

internal/scaffold/scaffold_test.go

workflow_call_alignment_test.goUpdate workflow-call alignment tests for inlined dispatch stage jobs +39/-41

Update workflow-call alignment tests for inlined dispatch stage jobs

• Adjusts concurrency expectations to match the new -agent- groups and fromJSON(needs.route.outputs.event_payload) usage. Removes/updates validations that assumed stage jobs used workflow_call uses: fields, and repoints reusable-dispatch tests to dispatch.yml.

internal/scaffold/workflow_call_alignment_test.go

Documentation (1) +6 / -8

shim-per-repo.yamlUpdate per-repo shim comments to reference dispatch.yml and inlined stages +6/-8

Update per-repo shim comments to reference dispatch.yml and inlined stages

• Adjusts template documentation to reflect that routing now targets dispatch.yml and that stage execution is inlined (ADR 62). Updates concurrency explanation to match per-stage job groups with the -agent- suffix.

internal/scaffold/fullsend-repo/templates/shim-per-repo.yaml

[github-actions]

Site preview

Preview: https://f8fa1691-site.fullsend-ai.workers.dev

Commit: d61aee3001ca3d7a14a93959ff99a8ad0e159581

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[qodo-code-review]

Code Review by Qodo

🐞 Bugs (1) 📘 Rule violations (0) 📎 Requirement gaps (0) 📜 Skill insights (0)

Context used

✅ Tickets: 🎫 Review multi-agent trap article for insights

✅ Compliance rules (platform): 61 rules

✅ Skills: writing-user-docs, writing-adrs

1. Legacy defaults path breaks jobs 🐞 Bug ☼ Reliability

Description

dispatch.yml skips the upstream defaults checkout when only the legacy vendored marker
.fullsend/.defaults/action.yml exists, but then immediately runs local actions from
./.defaults/..., so those jobs fail because .defaults/ was never created. This breaks per-repo
installs that still vendor defaults under .fullsend/.defaults/ (a layout still recognized by the
repo’s vendoring/cleanup logic).

Code

.github/workflows/dispatch.yml[R445-462]

+      - name: Checkout upstream defaults
+        if: hashFiles('.defaults/action.yml', '.fullsend/.defaults/action.yml') == ''
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          repository: ${{ job.workflow_repository }}
+          ref: ${{ job.workflow_sha }}
+          path: .defaults
+          fetch-depth: 1
+          sparse-checkout: |
+            .github/actions/
+            .github/scripts/
+            internal/scaffold/fullsend-repo/
+            action.yml
+
+      - name: Prepare workspace
+        id: workspace
+        uses: ./.defaults/.github/actions/prepare-workspace
+        with:

Relevance

⭐⭐⭐ High

Team fixes workflow vendoring/checkout reliability issues; vendoring path correctness addressed in
PRs #1954/#2545.

PR-#1954
PR-#2545
PR-#2689

ⓘ Recommendations generated based on similar findings in past PRs

Evidence

The workflow’s checkout gating treats .fullsend/.defaults/action.yml as sufficient to skip
creating .defaults/, but the next step uses a local action under ./.defaults/..., which requires
.defaults/ to exist. The repo’s own vendoring tests show .fullsend/.defaults/action.yml is a
recognized legacy vendored path, so this is a reachable state.

.github/workflows/dispatch.yml[445-465]
.github/actions/prepare-workspace/action.yml[24-64]
internal/scaffold/vendormanifest_test.go[47-52]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

### Issue description
`dispatch.yml` uses `hashFiles('.defaults/action.yml', '.fullsend/.defaults/action.yml') == ''` to decide whether to checkout upstream defaults into `.defaults/`, but subsequent steps unconditionally reference local actions under `./.defaults/...` (e.g., `./.defaults/.github/actions/prepare-workspace`). If the repo only has the legacy vendored marker under `.fullsend/.defaults/action.yml` (and no `.defaults/` directory), the checkout is skipped and the first local action reference fails.

### Issue Context
The codebase still acknowledges the legacy `.fullsend/.defaults/action.yml` path as a possible vendored path (e.g., vendor manifest cleanup tests). The new composite action also assumes `.defaults/...` for layered content.

### Fix Focus Areas
- .github/workflows/dispatch.yml[445-465]

### Implementation guidance
Pick one of these approaches:
1) **Fail-safe checkout condition:** change the checkout guard to only key off `.defaults/action.yml` (so `.defaults/` is guaranteed to exist when later `uses: ./.defaults/...` steps run).

2) **Legacy bridge step:** after “Checkout config repository” and before any `uses: ./.defaults/...` step, add a `run:` step that:
  - detects `[[ -f .fullsend/.defaults/action.yml && ! -f .defaults/action.yml ]]`
  - creates `.defaults/` and copies/syncs from `.fullsend/.defaults/` into `.defaults/` (or symlinks) so subsequent local action paths resolve.

If you keep the legacy marker in the `hashFiles()` guard, you still need option (2), otherwise you’ll keep skipping the checkout without creating `.defaults/`.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

---

2. Unused dispatchStageUses variable ✓ Resolved 📘 Rule violation ✧ Quality

Description

dispatchStageUses is declared but never used, which causes a Go compile error and will fail `go
vet during make lint`. This blocks the PR from meeting the lint-gating requirement.

Code

internal/scaffold/render.go[R126-133]

+// RenderDispatchPerRepoStagePaths is deprecated (ADR 62: stage workflows inlined
+// into dispatch.yml, no uses: lines to rewrite). Kept for backward
+// compatibility; returns content unchanged.
func RenderDispatchPerRepoStagePaths(content []byte) []byte {
-	return dispatchStageUses.ReplaceAll(content, []byte(`uses: ./.github/workflows/reusable-$1.yml`))
+	return content
}

var dispatchStageUses = regexp.MustCompile(`uses: fullsend-ai/fullsend/\.github/workflows/reusable-([a-z-]+)\.yml@[^\s]+`)

Relevance

⭐⭐⭐ High

Lint/compile breakers are treated as must-fix; similar compile-break issues fixed (duplicate key) in
PR #1016.

PR-#1016

ⓘ Recommendations generated based on similar findings in past PRs

Evidence

The rule requires make lint to pass. make lint runs pre-commit run, and the repo’s pre-commit
configuration runs go vet ./..., which will fail because dispatchStageUses is declared but
unused in Go code.

Rule 1062039: All code changes must pass make lint without failures
internal/scaffold/render.go[126-133]
.pre-commit-config.yaml[99-113]
Makefile[74-76]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
`internal/scaffold/render.go` declares `dispatchStageUses` but no code references it after `RenderDispatchPerRepoStagePaths()` was changed to a no-op. In Go, unused package-level variables (and their now-unused imports) cause compilation to fail, which will break `go vet` (and therefore `make lint`).

## Issue Context
`make lint` runs `pre-commit run`, which includes a `go vet ./...` hook.

## Fix Focus Areas
- internal/scaffold/render.go[126-133]
- .pre-commit-config.yaml[99-113]
- Makefile[74-76]

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

---

[fullsend-ai-review]

Review

Findings

Medium

• [protected-path] .github/actions/prepare-workspace/action.yml, .github/workflows/reusable-dispatch.yml — PR modifies files under the .github/ protected path. The PR links to issue Implement ADR 62: inline stage workflows into reusable-dispatch.yml #2884 and references ADR Review multi-agent trap article for insights #62, providing sufficient context for the change. Human approval is always required for protected-path changes, regardless of authorization context.

Low

• [stale-comment] internal/scaffold/fullsend-repo/templates/shim-per-repo.yaml — Line 17 states concurrency groups use -agent- suffix (stage jobs with -agent- suffix), but the actual inlined stage groups in reusable-dispatch.yml use fullsend-{stage}- without -agent- (e.g., fullsend-triage-${{ github.repository }}-...). The standalone reusable-{stage}.yml files do use -agent- in their groups, but the per-repo path no longer hits those after inlining.
  Remediation: Update the shim template comment to match the actual inlined group format: stage jobs (fullsend-{stage}- pattern).

• [stale-doc] docs/ADRs/0033-per-repo-installation-mode.md — Multiple sections reference pre-ADR-62 architecture: Resolved Questions (line 351) states 3-level nesting, dispatch mechanism description (line 189) references calling separate reusable-{stage}.yml files, and architecture diagram (lines 119–123) shows arrows to separate stage workflow files. After this PR, stages are inlined into reusable-dispatch.yml with 2-level nesting. Minor annotations noting ADR 62 changed this are permitted under ADR immutability rules.

• [stale-doc] docs/ADRs/0044-deprecate-per-org-installation-mode.md — Lines 78 and 158 reference the pre-ADR-62 shim → reusable-dispatch.yml → reusable-{stage}.yml chain. After this PR, stages are inlined with 2-level nesting for per-repo mode. Minor annotation per ADR immutability rules.

• [workflow-comment-consistency] .github/workflows/reusable-dispatch.yml — Inlined stage jobs do not include the safety comment explaining checkout@v7 fork PR checkout blocking that all six standalone reusable-{stage}.yml workflows include in their checkout steps (e.g., "checkout@v7 blocks fork PR checkouts on pull_request_target by default. Safe here: only .fullsend/ config is read...").

---

Changes from prior review

PR was rebased onto updated main — no code changes since prior review at f3030519. All findings from the prior review carry forward unchanged.

Previously resolved findings remain resolved:

• ✅ [logic-error] HIGH → resolved: Bare script paths now use FULLSEND_DIR pattern ("${FULLSEND_DIR:+$FULLSEND_DIR/}scripts/...")
• ✅ [defense-in-depth] MEDIUM → resolved: ref: pinning added to all six "Checkout config repository" steps
• ✅ [logic-discrepancy] MEDIUM → resolved: Dual-path hashFiles('.defaults/action.yml', '.fullsend/.defaults/action.yml') used in all six jobs
• ✅ [stale-comment] MEDIUM → resolved: Header comment updated to match actual fullsend-{stage}- concurrency group format

Verification notes

• Permission blocks: All six inlined stage jobs declare identical permissions: blocks to their standalone counterparts — no expansion or reduction.
• Checkout security: All allow-unsafe-pr-checkout usages are safe — ref: pins to github.event.pull_request.base.sha (base branch), not PR head. No fork code is checked out.
• Injection defense: All ::error:: and ::warning:: commands use static strings or pre-validated values (PR_NUM validated with ^[1-9][0-9]*$, BYTE_COUNT from wc -c).
• Go code: Clean removal of RenderDispatchPerRepoStagePaths and dispatchStageUses — no remaining references outside the diff. Test removals correspond exactly to removed functionality.
• Test integrity: Removed tests validated mechanisms that no longer exist (fully-qualified uses: paths, stage path rewriting). Remaining tests correctly updated (e.g., project_number threading assertion changed from with: to env var pattern).
• Prepare-workspace action: Faithfully extracts inline workspace prep logic. No path traversal risk — source paths are hardcoded, LAYERED_DIRS is a static list.

Previous run

Review

Findings

Medium

• [protected-path] .github/actions/prepare-workspace/action.yml, .github/workflows/reusable-dispatch.yml — PR modifies files under the .github/ protected path. The PR links to issue Implement ADR 62: inline stage workflows into reusable-dispatch.yml #2884 and references ADR Review multi-agent trap article for insights #62, providing sufficient context for the change. Human approval is always required for protected-path changes, regardless of authorization context.

Low

• [stale-comment] internal/scaffold/fullsend-repo/templates/shim-per-repo.yaml — Line 17 states concurrency groups use -agent- suffix (stage jobs with -agent- suffix), but the actual inlined stage groups in reusable-dispatch.yml use fullsend-{stage}- without -agent- (e.g., fullsend-triage-${{ github.repository }}-...). The standalone reusable-{stage}.yml files do use -agent- in their groups, but the per-repo path no longer hits those after inlining.
  Remediation: Update the shim template comment to match the actual inlined group format: stage jobs (fullsend-{stage}- pattern).

• [stale-doc] docs/ADRs/0033-per-repo-installation-mode.md — Multiple sections reference pre-ADR-62 architecture: Resolved Questions (line 351) states 3-level nesting, dispatch mechanism description (line 189) references calling separate reusable-{stage}.yml files, and architecture diagram (lines 119–123) shows arrows to separate stage workflow files. After this PR, stages are inlined into reusable-dispatch.yml with 2-level nesting. Minor annotations noting ADR 62 changed this are permitted under ADR immutability rules.

• [stale-doc] docs/ADRs/0044-deprecate-per-org-installation-mode.md — Lines 78 and 158 reference the pre-ADR-62 shim → reusable-dispatch.yml → reusable-{stage}.yml chain. After this PR, stages are inlined with 2-level nesting for per-repo mode. Minor annotation per ADR immutability rules.

• [workflow-comment-consistency] .github/workflows/reusable-dispatch.yml — Inlined stage jobs do not include the safety comment explaining checkout@v7 fork PR checkout blocking that all six standalone reusable-{stage}.yml workflows include in their checkout steps (e.g., "checkout@v7 blocks fork PR checkouts on pull_request_target by default. Safe here: only .fullsend/ config is read...").

---

Changes from prior review

All findings from the prior review at d6537eda that required code changes have been resolved:

• ✅ [logic-error] HIGH → resolved: Bare script paths now use FULLSEND_DIR pattern ("${FULLSEND_DIR:+$FULLSEND_DIR/}scripts/...")
• ✅ [defense-in-depth] MEDIUM → resolved: ref: pinning added to all six "Checkout config repository" steps
• ✅ [logic-discrepancy] MEDIUM → resolved: Dual-path hashFiles('.defaults/action.yml', '.fullsend/.defaults/action.yml') used in all six jobs
• ✅ [stale-comment] MEDIUM → resolved: Header comment updated to match actual fullsend-{stage}- concurrency group format

Previous run

Review

Findings

Medium

• [protected-path] .github/actions/prepare-workspace/action.yml, .github/workflows/reusable-dispatch.yml — PR modifies files under the .github/ protected path. The PR links to issue Implement ADR 62: inline stage workflows into reusable-dispatch.yml #2884 and references ADR Review multi-agent trap article for insights #62, providing sufficient context for the change. Human approval is always required for protected-path changes, regardless of authorization context.

Low

• [stale-comment] internal/scaffold/fullsend-repo/templates/shim-per-repo.yaml — Line 17 states concurrency groups use -agent- suffix (stage jobs with -agent- suffix), but the actual inlined stage groups in reusable-dispatch.yml use fullsend-{stage}- without -agent- (e.g., fullsend-triage-${{ github.repository }}-...). The standalone reusable-{stage}.yml files do use -agent- in their groups, but the per-repo path no longer hits those after inlining.
  Remediation: Update the shim template comment to match the actual inlined group format: stage jobs (fullsend-{stage}- pattern).

• [stale-doc] docs/ADRs/0033-per-repo-installation-mode.md — Multiple sections reference pre-ADR-62 architecture: Resolved Questions (line 351) states 3-level nesting, dispatch mechanism description (line 189) references calling separate reusable-{stage}.yml files, and architecture diagram (lines 119–123) shows arrows to separate stage workflow files. After this PR, stages are inlined into reusable-dispatch.yml with 2-level nesting. Minor annotations noting ADR 62 changed this are permitted under ADR immutability rules.

• [stale-doc] docs/ADRs/0044-deprecate-per-org-installation-mode.md — Lines 78 and 158 reference the pre-ADR-62 shim → reusable-dispatch.yml → reusable-{stage}.yml chain. After this PR, stages are inlined with 2-level nesting for per-repo mode. Minor annotation per ADR immutability rules.

• [workflow-comment-consistency] .github/workflows/reusable-dispatch.yml — Inlined stage jobs do not include the safety comment explaining checkout@v7 fork PR checkout blocking that all six standalone reusable-{stage}.yml workflows include in their checkout steps (e.g., "checkout@v7 blocks fork PR checkouts on pull_request_target by default. Safe here: only .fullsend/ config is read...").

---

Changes from prior review

All findings from the prior review at d6537eda that required code changes have been resolved:

• ✅ [logic-error] HIGH → resolved: Bare script paths now use FULLSEND_DIR pattern ("${FULLSEND_DIR:+$FULLSEND_DIR/}scripts/...")
• ✅ [defense-in-depth] MEDIUM → resolved: ref: pinning added to all six "Checkout config repository" steps
• ✅ [logic-discrepancy] MEDIUM → resolved: Dual-path hashFiles('.defaults/action.yml', '.fullsend/.defaults/action.yml') used in all six jobs
• ✅ [stale-comment] MEDIUM → resolved: Header comment updated to match actual fullsend-{stage}- concurrency group format

Previous run (2)

Review

Findings

High

• [logic-error] .github/workflows/reusable-dispatch.yml — Three inlined stage jobs run pre-scripts with bare paths (bash scripts/pre-code.sh, bash scripts/pre-fetch-prior-review.sh, bash scripts/pre-fix.sh). In per-repo mode, the prepare-workspace composite action copies scripts to .fullsend/scripts/ (via the LAYERED_DIRS loop with DEST=".fullsend/"), so the bare path scripts/pre-code.sh resolves to the workspace root where the file does not exist. The standalone workflows use the FULLSEND_DIR env var pattern: FULLSEND_DIR: ${{ inputs.install_mode == 'per-repo' && '.fullsend' || '' }} with bash "${FULLSEND_DIR:+$FULLSEND_DIR/}scripts/pre-code.sh". Since reusable-dispatch.yml is called by per-repo shims with install_mode: per-repo, the code, review, and fix agents will fail with file-not-found errors on every per-repo run.
  Remediation: Add FULLSEND_DIR: ${{ inputs.install_mode == 'per-repo' && '.fullsend' || '' }} to the env: block of each pre-script step and change the run: commands to bash "${FULLSEND_DIR:+$FULLSEND_DIR/}scripts/<script>.sh" — matching the standalone workflow pattern.

Medium

• [defense-in-depth] .github/workflows/reusable-dispatch.yml — All six inlined stage jobs omit the ref: parameter on the "Checkout config repository" step. The standalone reusable-{stage}.yml workflows all use ref: ${{ github.event_name == 'pull_request_target' && github.event.pull_request.base.sha || github.sha }} to pin checkout to a specific commit SHA, and the route job in this same file also uses this pinning. For pull_request_target events, the default checkout ref is github.ref (the base branch ref), so the checkout is still safe — it does NOT check out the PR head. However, omitting ref: means the checkout uses a branch ref rather than a pinned SHA, losing defense-in-depth against TOCTOU if the base branch is force-pushed between trigger and checkout.
  Remediation: Add ref: ${{ github.event_name == 'pull_request_target' && github.event.pull_request.base.sha || github.sha }} to all six "Checkout config repository" steps.

• [logic-discrepancy] .github/workflows/reusable-dispatch.yml — All six inlined stage jobs use hashFiles('.defaults/action.yml') (single path) as the condition for "Checkout upstream defaults", while standalone workflows use hashFiles('.defaults/action.yml', '.fullsend/.defaults/action.yml') (dual path). The second path covers per-repo vendored installs where defaults are already present at .fullsend/.defaults/. With the single-path check, vendored per-repo installs will redundantly re-checkout upstream defaults, potentially overwriting the vendored copy.
  Remediation: Change to hashFiles('.defaults/action.yml', '.fullsend/.defaults/action.yml') == '' to match the standalone pattern.

• [stale-comment] .github/workflows/reusable-dispatch.yml — The updated file header comment (lines 6–8) states concurrency groups use the -agent- suffix (fullsend-{stage}-agent-...) but the actual inlined job concurrency groups use fullsend-{stage}- without -agent- (e.g., fullsend-triage-${{ github.repository }}-...). The comment incorrectly describes the group format.
  Remediation: Either update the comment to accurately reflect the fullsend-{stage}- prefix used by the dispatch-level groups, or change the concurrency groups to use the -agent- prefix to match the standalone workflows.

• [protected-path] .github/actions/prepare-workspace/action.yml, .github/workflows/reusable-dispatch.yml — PR modifies files under the .github/ protected path. The PR links to issue Implement ADR 62: inline stage workflows into reusable-dispatch.yml #2884 and references ADR Review multi-agent trap article for insights #62, providing sufficient context for the change. Human approval is always required for protected-path changes, regardless of authorization context.

Low

• [GHA workflow command injection] .github/workflows/reusable-dispatch.yml — Pre-existing: two instances of unsanitized interpolation into workflow commands in the route job (unchanged by this PR). Mitigated by GitHub username/repo format restrictions. No new injection vectors introduced by the inlined stage jobs — all ::error:: and ::warning:: messages in the new code either use static strings or interpolate validated numeric values (PR_NUM validated against ^[1-9][0-9]*$, BYTE_COUNT from wc -c).

• [stale-doc] docs/ADRs/0033-per-repo-installation-mode.md — Multiple sections reference pre-ADR-62 architecture: Resolved Questions (line 351) states 3-level nesting, dispatch mechanism description (line 189) references calling separate reusable-{stage}.yml files, and architecture diagram (lines 119–123) shows arrows to separate stage workflow files. After this PR, stages are inlined into reusable-dispatch.yml with 2-level nesting. Minor annotations noting ADR 62 changed this are permitted under ADR immutability rules.

• [stale-doc] docs/ADRs/0044-deprecate-per-org-installation-mode.md — Line 158 references the pre-ADR-62 shim → reusable-dispatch.yml → reusable-{stage}.yml chain. After this PR, stages are inlined with 2-level nesting for per-repo mode. Minor annotation per ADR immutability rules.

• [workflow-comment-consistency] .github/workflows/reusable-dispatch.yml — Inlined stage jobs do not include the safety comment explaining checkout@v7 fork PR checkout blocking that all six standalone reusable-{stage}.yml workflows include in their checkout steps (e.g., "checkout@v7 blocks fork PR checkouts on pull_request_target by default. Safe here: only .fullsend/ config is read...").

Previous run (3)

Review

Findings

High

• [logic-error] .github/workflows/reusable-dispatch.yml — All six inlined stage jobs invoke the ./.defaults/ composite action without passing the fullsend-dir input. The standalone reusable-{stage}.yml workflows all pass fullsend-dir: ${{ inputs.install_mode == 'per-repo' && '.fullsend' || '' }}. Without this input, the composite action defaults fullsend-dir to GITHUB_WORKSPACE, so fullsend run will look for agent config in the workspace root instead of .fullsend/ in per-repo mode. Since reusable-dispatch.yml is exclusively used for per-repo mode, this would cause agent failures for every run.
  Remediation: Add fullsend-dir: ${{ inputs.install_mode == 'per-repo' && '.fullsend' || '' }} to the with: block of every uses: ./.defaults/ step in the triage, code, review, fix, retro, and prioritize jobs.

• [logic-error] .github/workflows/reusable-dispatch.yml — Three inlined stage jobs run pre-scripts with bare paths (bash scripts/pre-code.sh, bash scripts/pre-fetch-prior-review.sh, bash scripts/pre-fix.sh). In per-repo mode, the prepare-workspace action copies scripts to .fullsend/scripts/, so the bare path scripts/pre-code.sh will produce a file-not-found error. Standalone workflows use FULLSEND_DIR env var and ${FULLSEND_DIR:+$FULLSEND_DIR/}scripts/... pattern to handle both modes.
  Remediation: Set FULLSEND_DIR env var (matching the standalone pattern) and use ${FULLSEND_DIR:+$FULLSEND_DIR/}scripts/<script>.sh for all pre-script invocations in the code, review, and fix jobs.

Medium

• [defense-in-depth] .github/workflows/reusable-dispatch.yml — All six inlined stage jobs omit the ref: parameter on the "Checkout config repository" step. The standalone reusable-{stage}.yml workflows use ref: ${{ github.event_name == 'pull_request_target' && github.event.pull_request.base.sha || github.sha }} to pin checkout to a specific commit SHA. For pull_request_target events, the default checkout ref is github.ref (the base branch ref), so the checkout is still safe — it does NOT check out the PR head. However, omitting ref: means the checkout uses a branch ref rather than a pinned SHA, losing defense-in-depth against TOCTOU if the base branch is force-pushed between trigger and checkout.

• [logic-discrepancy] .github/workflows/reusable-dispatch.yml — All six inlined stage jobs use hashFiles('.defaults/action.yml') (single path) as guard for "Checkout upstream defaults", while standalone workflows use hashFiles('.defaults/action.yml', '.fullsend/.defaults/action.yml') (dual path). The second path covers per-repo vendored installs where defaults are already present at .fullsend/.defaults/. With the single-path check, vendored per-repo installs will redundantly re-checkout upstream defaults, overwriting the vendored copy.

• [stale-comment] .github/workflows/reusable-dispatch.yml — The updated file header comment states concurrency groups use -agent- suffix (fullsend-{stage}-agent-...) but the actual inlined job concurrency groups use fullsend-{stage}- without -agent- (e.g., fullsend-triage-${{ github.repository }}-...). The comment incorrectly describes the group format.

• [protected-path] .github/actions/prepare-workspace/action.yml, .github/workflows/reusable-dispatch.yml — PR modifies files under the .github/ protected path. The PR links to issue Implement ADR 62: inline stage workflows into reusable-dispatch.yml #2884 and references ADR Review multi-agent trap article for insights #62, providing sufficient context for the change. Human approval is always required for protected-path changes, regardless of authorization context.

Low

• [GHA workflow command injection] .github/workflows/reusable-dispatch.yml — Pre-existing: two instances of unsanitized interpolation into workflow commands in the route job (unchanged by this PR). Mitigated by GitHub username/repo format restrictions. No new injection vectors introduced by the inlined stage jobs.

• [stale-doc] docs/ADRs/0033-per-repo-installation-mode.md — Multiple sections reference pre-ADR-62 architecture: Resolved Questions (line 351) states 3-level nesting, dispatch mechanism description (line 187) references calling separate reusable-{stage}.yml files, and architecture diagram (lines 119–123) shows arrows to separate stage workflow files. After this PR, stages are inlined into reusable-dispatch.yml with 2-level nesting. Minor annotations noting ADR 62 changed this are permitted under ADR immutability rules.

• [stale-doc] docs/ADRs/0044-deprecate-per-org-installation-mode.md — Lines 78 and 158 reference the pre-ADR-62 shim → reusable-dispatch.yml → reusable-{stage}.yml chain. After this PR, stages are inlined with 2-level nesting for per-repo mode.

• [workflow-comment-consistency] .github/workflows/reusable-dispatch.yml — Inlined stage jobs do not include the safety comment explaining checkout@v7 fork PR checkout blocking that all six standalone reusable-{stage}.yml workflows include in their checkout steps.

Previous run (4)

Review

Findings

High

• [logic-error] .github/workflows/reusable-dispatch.yml — All six inlined stage jobs invoke the ./.defaults/ composite action without passing the fullsend-dir input. The standalone reusable-{stage}.yml workflows all pass fullsend-dir: ${{ inputs.install_mode == 'per-repo' && '.fullsend' || '' }}. Without this input, the composite action defaults fullsend-dir to GITHUB_WORKSPACE, so fullsend run will look for agent config in the workspace root instead of .fullsend/ in per-repo mode. Since reusable-dispatch.yml is exclusively used for per-repo mode, this would cause agent failures for every run.
  Remediation: Add fullsend-dir: ${{ inputs.install_mode == 'per-repo' && '.fullsend' || '' }} to the with: block of every uses: ./.defaults/ step in the triage, code, review, fix, retro, and prioritize jobs.

• [logic-error] .github/workflows/reusable-dispatch.yml — Three inlined stage jobs run pre-scripts with bare paths (bash scripts/pre-code.sh, bash scripts/pre-fetch-prior-review.sh, bash scripts/pre-fix.sh). In per-repo mode, the prepare-workspace action copies scripts to .fullsend/scripts/, so the bare path scripts/pre-code.sh will produce a file-not-found error. Standalone workflows use FULLSEND_DIR env var and ${FULLSEND_DIR:+$FULLSEND_DIR/}scripts/... pattern to handle both modes.
  Remediation: Set FULLSEND_DIR env var (matching the standalone pattern) and use ${FULLSEND_DIR:+$FULLSEND_DIR/}scripts/<script>.sh for all pre-script invocations in the code, review, and fix jobs.

Medium

• [defense-in-depth] .github/workflows/reusable-dispatch.yml — All six inlined stage jobs omit the ref: parameter on the "Checkout config repository" step. The standalone reusable-{stage}.yml workflows use ref: ${{ github.event_name == 'pull_request_target' && github.event.pull_request.base.sha || github.sha }} to pin checkout to a specific commit SHA. For pull_request_target events, the default checkout ref is github.ref (the base branch ref), so the checkout is still safe — it does NOT check out the PR head. However, omitting ref: means the checkout uses a branch ref rather than a pinned SHA, losing defense-in-depth against TOCTOU if the base branch is force-pushed between trigger and checkout.

• [logic-discrepancy] .github/workflows/reusable-dispatch.yml — All six inlined stage jobs use hashFiles('.defaults/action.yml') (single path) as guard for "Checkout upstream defaults", while standalone workflows use hashFiles('.defaults/action.yml', '.fullsend/.defaults/action.yml') (dual path). The second path covers per-repo vendored installs where defaults are already present at .fullsend/.defaults/. With the single-path check, vendored per-repo installs will redundantly re-checkout upstream defaults, overwriting the vendored copy.

• [stale-comment] .github/workflows/reusable-dispatch.yml — The updated file header comment states concurrency groups use -agent- suffix (fullsend-{stage}-agent-...) but the actual inlined job concurrency groups use fullsend-{stage}- without -agent- (e.g., fullsend-triage-${{ github.repository }}-...). The comment incorrectly describes the group format.

• [protected-path] .github/actions/prepare-workspace/action.yml, .github/workflows/reusable-dispatch.yml — PR modifies files under the .github/ protected path. The PR links to issue Implement ADR 62: inline stage workflows into reusable-dispatch.yml #2884 and references ADR Review multi-agent trap article for insights #62, providing sufficient context for the change. Human approval is always required for protected-path changes, regardless of authorization context.

Low

• [GHA workflow command injection] .github/workflows/reusable-dispatch.yml — Pre-existing: two instances of unsanitized interpolation into workflow commands in the route job (unchanged by this PR). Mitigated by GitHub username/repo format restrictions. No new injection vectors introduced by the inlined stage jobs.

• [stale-doc] docs/ADRs/0033-per-repo-installation-mode.md — Multiple sections reference pre-ADR-62 architecture: Resolved Questions (line 351) states 3-level nesting, dispatch mechanism description (line 187) references calling separate reusable-{stage}.yml files, and architecture diagram (lines 119–123) shows arrows to separate stage workflow files. After this PR, stages are inlined into reusable-dispatch.yml with 2-level nesting. Minor annotations noting ADR 62 changed this are permitted under ADR immutability rules.

• [stale-doc] docs/ADRs/0044-deprecate-per-org-installation-mode.md — Lines 78 and 158 reference the pre-ADR-62 shim → reusable-dispatch.yml → reusable-{stage}.yml chain. After this PR, stages are inlined with 2-level nesting for per-repo mode.

• [workflow-comment-consistency] .github/workflows/reusable-dispatch.yml — Inlined stage jobs do not include the safety comment explaining checkout@v7 fork PR checkout blocking that all six standalone reusable-{stage}.yml workflows include in their checkout steps.

Previous run (5)

Review

Findings

High

• [logic-error] .github/workflows/reusable-dispatch.yml — All six inlined stage jobs are missing the fullsend-dir input in their ./.defaults/ agent action invocations (the "Run {stage} agent" steps). The standalone reusable-{stage}.yml workflows all pass fullsend-dir: ${{ inputs.install_mode == 'per-repo' && '.fullsend' || '' }} to the ./.defaults/ action. The inlined code correctly passes fullsend-dir to the setup-gcp action in all six jobs, but omits it from the agent action step. Without this, the agent CLI will look for agents/skills/harness/policies in the workspace root instead of .fullsend/ in per-repo mode, breaking per-repo agent runs for all stages.
  Remediation: Add fullsend-dir: ${{ inputs.install_mode == 'per-repo' && '.fullsend' || '' }} to the with: block of each "Run {stage} agent" step (the uses: ./.defaults/ invocations).

• [logic-error] .github/workflows/reusable-dispatch.yml — The code, review, and fix inlined jobs use bare script paths (e.g., bash scripts/pre-code.sh) without accounting for per-repo mode's .fullsend/ prefix. The standalone workflows use bash "${FULLSEND_DIR:+$FULLSEND_DIR/}scripts/pre-code.sh" with a FULLSEND_DIR env var. The prepare-workspace action copies scripts to .fullsend/scripts/ in per-repo mode, so the bare path scripts/pre-code.sh will fail with file-not-found in per-repo mode.
  Remediation: Set FULLSEND_DIR env var (matching the standalone pattern) and use ${FULLSEND_DIR:+$FULLSEND_DIR/}scripts/... for all pre-script invocations.

• [test-code-mismatch] internal/scaffold/workflow_call_alignment_test.go — dispatchStageConcurrencyExpectations is updated to expect -agent- prefixed concurrency groups (e.g., fullsend-triage-agent-) and fromJSON(needs.route.outputs.event_payload) expressions, but the actual concurrency groups in reusable-dispatch.yml are unchanged: they still use fullsend-triage- without -agent- and reference github.event.issue.number, not fromJSON(...). TestReusableDispatchStageConcurrency will fail on all six stages. The header comment also claims groups use the -agent- suffix, but the groups themselves were not updated.
  Remediation: Either update the concurrency groups in reusable-dispatch.yml to match the new test expectations, or revert the test expectations to match the actual workflow code.

• [logic-error] .github/workflows/reusable-dispatch.yml — All six inlined stage jobs are missing the ref: parameter on the "Checkout config repository" step. The standalone reusable-{stage}.yml workflows specify ref: ${{ github.event_name == 'pull_request_target' && github.event.pull_request.base.sha || github.sha }} to pin checkout to the base branch SHA during pull_request_target events. The route job in this same file correctly uses this pinning. Without ref: pinning, the base branch HEAD could change between event creation and checkout (TOCTOU), and the defense-in-depth property present in all standalone workflows is lost.
  Remediation: Add ref: ${{ github.event_name == 'pull_request_target' && github.event.pull_request.base.sha || github.sha }} to each "Checkout config repository" step.

Medium

• [protected-path] .github/actions/prepare-workspace/action.yml, .github/workflows/reusable-dispatch.yml — PR modifies files under the .github/ protected path. The PR links to issue Implement ADR 62: inline stage workflows into reusable-dispatch.yml #2884 and references ADR Review multi-agent trap article for insights #62, providing sufficient context for the change. Human approval is always required for protected-path changes, regardless of authorization context.

• [logic-discrepancy] .github/workflows/reusable-dispatch.yml — The "Checkout upstream defaults" conditional in all six inlined jobs uses hashFiles('.defaults/action.yml') == '' (single path), while the standalone reusable-{stage}.yml workflows check hashFiles('.defaults/action.yml', '.fullsend/.defaults/action.yml') == ''. The missing second path means vendored per-repo installs that have .fullsend/.defaults/action.yml will unnecessarily re-checkout upstream defaults, overwriting the vendored copy.

Low

• [GHA workflow command injection] .github/workflows/reusable-dispatch.yml — Pre-existing: Two instances of unsanitized interpolation into workflow commands in the route job (unchanged by this PR). Mitigated by GitHub username/repo format restrictions. No new injection vectors introduced by the inlined stage jobs.

• [stale-doc] docs/ADRs/0033-per-repo-installation-mode.md — Resolved Questions section states nesting depth is 3 levels (shim → reusable-dispatch.yml → reusable-{stage}.yml), but this PR changes it to 2 levels by inlining stages. The workflow header comment is updated but the ADR is not.

Previous run (6)

Review

Findings

High

• [logic-error] .github/workflows/reusable-dispatch.yml — All six inlined stage jobs are missing the fullsend-dir input in their ./.defaults/ agent action invocations (the "Run {stage} agent" steps). The standalone reusable-{stage}.yml workflows all pass fullsend-dir: ${{ inputs.install_mode == 'per-repo' && '.fullsend' || '' }} to the ./.defaults/ action. The inlined code correctly passes fullsend-dir to the setup-gcp action in all six jobs, but omits it from the agent action step. Without this, the agent CLI will look for agents/skills/harness/policies in the workspace root instead of .fullsend/ in per-repo mode, breaking per-repo agent runs for all stages.
  Remediation: Add fullsend-dir: ${{ inputs.install_mode == 'per-repo' && '.fullsend' || '' }} to the with: block of each "Run {stage} agent" step (the uses: ./.defaults/ invocations).

• [logic-error] .github/workflows/reusable-dispatch.yml — The code, review, and fix inlined jobs use bare script paths (e.g., bash scripts/pre-code.sh) without accounting for per-repo mode's .fullsend/ prefix. The standalone workflows use bash "${FULLSEND_DIR:+$FULLSEND_DIR/}scripts/pre-code.sh" with a FULLSEND_DIR env var. The prepare-workspace action copies scripts to .fullsend/scripts/ in per-repo mode, so the bare path scripts/pre-code.sh will fail with file-not-found in per-repo mode.
  Remediation: Set FULLSEND_DIR env var (matching the standalone pattern) and use ${FULLSEND_DIR:+$FULLSEND_DIR/}scripts/... for all pre-script invocations.

• [test-code-mismatch] internal/scaffold/workflow_call_alignment_test.go — dispatchStageConcurrencyExpectations is updated to expect -agent- prefixed concurrency groups (e.g., fullsend-triage-agent-) and fromJSON(needs.route.outputs.event_payload) expressions, but the actual concurrency groups in reusable-dispatch.yml are unchanged: they still use fullsend-triage- without -agent- and reference github.event.issue.number, not fromJSON(...). TestReusableDispatchStageConcurrency will fail on all six stages. The header comment also claims groups use the -agent- suffix, but the groups themselves were not updated.
  Remediation: Either update the concurrency groups in reusable-dispatch.yml to match the new test expectations, or revert the test expectations to match the actual workflow code.

• [logic-error] .github/workflows/reusable-dispatch.yml — All six inlined stage jobs are missing the ref: parameter on the "Checkout config repository" step. The standalone reusable-{stage}.yml workflows specify ref: ${{ github.event_name == 'pull_request_target' && github.event.pull_request.base.sha || github.sha }} to pin checkout to the base branch SHA during pull_request_target events. The route job in this same file correctly uses this pinning. Without ref: pinning, the base branch HEAD could change between event creation and checkout (TOCTOU), and the defense-in-depth property present in all standalone workflows is lost.
  Remediation: Add ref: ${{ github.event_name == 'pull_request_target' && github.event.pull_request.base.sha || github.sha }} to each "Checkout config repository" step.

Medium

• [protected-path] .github/actions/prepare-workspace/action.yml, .github/workflows/reusable-dispatch.yml — PR modifies files under the .github/ protected path. The PR links to issue Implement ADR 62: inline stage workflows into reusable-dispatch.yml #2884 and references ADR Review multi-agent trap article for insights #62, providing sufficient context for the change. Human approval is always required for protected-path changes, regardless of authorization context.

• [logic-discrepancy] .github/workflows/reusable-dispatch.yml — The "Checkout upstream defaults" conditional in all six inlined jobs uses hashFiles('.defaults/action.yml') == '' (single path), while the standalone reusable-{stage}.yml workflows check hashFiles('.defaults/action.yml', '.fullsend/.defaults/action.yml') == ''. The missing second path means vendored per-repo installs that have .fullsend/.defaults/action.yml will unnecessarily re-checkout upstream defaults, overwriting the vendored copy.

Low

• [GHA workflow command injection] .github/workflows/reusable-dispatch.yml — Pre-existing: Two instances of unsanitized interpolation into workflow commands in the route job (unchanged by this PR). Mitigated by GitHub username/repo format restrictions. No new injection vectors introduced by the inlined stage jobs.

• [stale-doc] docs/ADRs/0033-per-repo-installation-mode.md — Resolved Questions section states nesting depth is 3 levels (shim → reusable-dispatch.yml → reusable-{stage}.yml), but this PR changes it to 2 levels by inlining stages. The workflow header comment is updated but the ADR is not.

Previous run (7)

Review

Findings

High

• [logic-error] .github/workflows/reusable-dispatch.yml — The inlined code and fix jobs omit git config --global user.email and git config --global user.name from the "Resolve bot identity" step. The standalone reusable-code.yml (lines 173–174) and reusable-fix.yml (lines 163–164) both set these after exporting GIT_BOT_EMAIL to GITHUB_ENV. Without these config lines, commits created by the code or fix agents will use the runner's default identity instead of the minted bot identity, affecting commit attribution and potentially breaking downstream logic that checks commit author.
  Remediation: Add git config --global user.email "${GIT_BOT_EMAIL}" and git config --global user.name "${BOT_LOGIN}" to the "Resolve bot identity" step in both the inlined code job and the inlined fix job.

Medium

• [protected-path] .github/actions/prepare-workspace/action.yml, .github/workflows/reusable-dispatch.yml — PR modifies files under the .github/ protected path. The PR links to issue Implement ADR 62: inline stage workflows into reusable-dispatch.yml #2884 and references ADR Review multi-agent trap article for insights #62, providing sufficient context for the change. Human approval is always required for protected-path changes, regardless of authorization context.

Low

• [logic-discrepancy] .github/workflows/reusable-dispatch.yml — The "Checkout upstream defaults" step in all inlined jobs uses hashFiles('.defaults/action.yml') == '', while the standalone reusable-{stage}.yml files check hashFiles('.defaults/action.yml', '.fullsend/.defaults/action.yml') == ''. Since all subsequent steps reference .defaults/ (not .fullsend/.defaults/), the inlined version's single-path check is functionally correct and arguably better. Noting for awareness only.

• [GHA workflow command injection] .github/workflows/reusable-dispatch.yml — Two pre-existing instances where values are interpolated into ::warning:: and ::error:: workflow commands without sanitization (line ~132: API error output; line ~398: repo full names in fork detection). Exploitation is very unlikely because the inputs are GitHub-controlled (usernames are alphanumeric+hyphens, repo names follow owner/name format, API errors are structured JSON).

Previous run (8)

Review

Findings

High

• [logic-error] .github/workflows/reusable-dispatch.yml — The inlined code and fix jobs omit git config --global user.email and git config --global user.name from the "Resolve bot identity" step. The standalone reusable-code.yml (lines 173–174) and reusable-fix.yml (lines 163–164) both set these after exporting GIT_BOT_EMAIL to GITHUB_ENV. Without these config lines, commits created by the code or fix agents will use the runner's default identity instead of the minted bot identity, affecting commit attribution and potentially breaking downstream logic that checks commit author.
  Remediation: Add git config --global user.email "${GIT_BOT_EMAIL}" and git config --global user.name "${BOT_LOGIN}" to the "Resolve bot identity" step in both the inlined code job (after the echo "GIT_BOT_EMAIL=..." line, around line 307) and the inlined fix job (around line 530).

Medium

• [protected-path] .github/actions/prepare-workspace/action.yml, .github/workflows/reusable-dispatch.yml — PR modifies files under the .github/ protected path. The PR links to issue Implement ADR 62: inline stage workflows into reusable-dispatch.yml #2884 and references ADR Review multi-agent trap article for insights #62, providing sufficient context for the change. Human approval is always required for protected-path changes, regardless of authorization context.

Low

• [logic-discrepancy] .github/workflows/reusable-dispatch.yml — The "Checkout upstream defaults" step in all inlined jobs uses hashFiles('.defaults/action.yml') == '', while the standalone reusable-{stage}.yml files check hashFiles('.defaults/action.yml', '.fullsend/.defaults/action.yml') == ''. Since all subsequent steps reference .defaults/ (not .fullsend/.defaults/), the inlined version's single-path check is functionally correct and arguably better. Noting for awareness only.

• [GHA workflow command injection] .github/workflows/reusable-dispatch.yml — Two pre-existing instances where values are interpolated into ::warning:: and ::error:: workflow commands without sanitization (line ~132: API error output; line ~398: repo full names in fork detection). Exploitation is very unlikely because the inputs are GitHub-controlled (usernames are alphanumeric+hyphens, repo names follow owner/name format, API errors are structured JSON).

Previous run

Review

Findings

High

• [logic-error] .github/workflows/reusable-dispatch.yml — The inlined code and fix jobs omit git config --global user.email and git config --global user.name from the "Resolve bot identity" step. The standalone reusable-code.yml (lines 173–174) and reusable-fix.yml (lines 163–164) both include these lines after exporting GIT_BOT_EMAIL to GITHUB_ENV. The post-scripts (post-code.sh, post-fix.sh) call git commit --amend --no-edit, which relies on the global git config for author/committer identity. Without these config lines, commits will use the runner's default git identity instead of the bot identity.
  Remediation: Add git config --global user.email "${GIT_BOT_EMAIL}" and git config --global user.name "${BOT_LOGIN}" to the "Resolve bot identity" step in both the inlined code job (after line ~308) and the inlined fix job (after line ~530).

Medium

• [logic-error] .github/workflows/reusable-dispatch.yml — The hashFiles condition in the "Checkout upstream defaults" step of all six inlined jobs checks only hashFiles('.defaults/action.yml'), while all standalone reusable-*.yml files check hashFiles('.defaults/action.yml', '.fullsend/.defaults/action.yml'). The second path is the vendored marker for per-repo installs. In per-repo vendored installs, the marker exists at .fullsend/.defaults/action.yml but not .defaults/action.yml, so the checkout step will unnecessarily run and overwrite the vendored content.
  Remediation: Change the if condition on all six "Checkout upstream defaults" steps to hashFiles('.defaults/action.yml', '.fullsend/.defaults/action.yml') == ''.

• [protected-path] .github/actions/prepare-workspace/action.yml, .github/workflows/reusable-dispatch.yml — PR modifies files under the .github/ protected path. The PR links to issue Implement ADR 62: inline stage workflows into reusable-dispatch.yml #2884 and references ADR Review multi-agent trap article for insights #62, providing sufficient context for the change. Human approval is always required for protected-path changes, regardless of authorization context.

• [step-duplication-vs-action] .github/workflows/reusable-dispatch.yml — The "Prepare workspace" logic now exists in two forms: the new composite action (used by inlined jobs in reusable-dispatch.yml) and inline bash scripts (in standalone reusable-{stage}.yml files kept for per-org mode). This creates a maintenance burden where workspace setup changes must be made in two places until per-org mode is removed (ADR 44).

Previous run

Review

Findings

High

• [logic-error] internal/scaffold/workflow_call_alignment_test.go — TestRoleCheckCaseBranches has double-prefix typo: loadRepoFile(".github/workflows/reusable-reusable-dispatch.yml") and loadScaffoldFile(".github/workflows/reusable-reusable-dispatch.yml"). Neither file exists. loadRepoFile reads from the repo root (../../path) where the file is .github/workflows/reusable-dispatch.yml. loadScaffoldFile reads from the embedded scaffold via FullsendRepoFile where the file is .github/workflows/dispatch.yml. Both test cases will fail with file-not-found errors.
  Remediation: Fix loadRepoFile path to .github/workflows/reusable-dispatch.yml and loadScaffoldFile path to .github/workflows/dispatch.yml.

• [logic-error] internal/scaffold/scaffold_test.go — Multiple tests changed to reference reusable-dispatch.yml instead of dispatch.yml in the scaffold, but the scaffold file at internal/scaffold/fullsend-repo/.github/workflows/dispatch.yml is NOT renamed in this PR. FullsendRepoFile reads from the embed.FS which only contains dispatch.yml. Affected tests: TestFullsendRepoFilesExist (expects reusable-dispatch.yml in file list), TestShimWorkflowCallTemplateContent (asserts reusable-dispatch.yml@main in rendered output), and TestDispatchWorkflowContent (calls FullsendRepoFile(".github/workflows/reusable-dispatch.yml")). All three will fail.
  Remediation: Either rename the scaffold file from dispatch.yml to reusable-dispatch.yml and include the rename in this PR, or revert these test changes to use dispatch.yml. Since dispatch.yml is the per-org scaffold workflow (distinct from the repo's reusable-dispatch.yml for per-repo mode), reverting is likely correct.

Medium

• [protected-path] .github/actions/prepare-workspace/action.yml, .github/workflows/reusable-dispatch.yml — PR modifies files under the .github/ protected path. The PR links to issue Implement ADR 62: inline stage workflows into reusable-dispatch.yml #2884 and references ADR Review multi-agent trap article for insights #62, providing sufficient context for the change. Human approval is always required for protected-path changes, regardless of authorization context.

Previous run

Review

Findings

High

• [stale-reference] .github/workflows/dispatch.yml — The PR renames reusable-dispatch.yml to dispatch.yml and deletes the old file. Existing non-vendored per-repo installations have shims with uses: fullsend-ai/fullsend/.github/workflows/reusable-dispatch.yml@v0. When the v0 tag is moved to include this commit, those shims will fail because reusable-dispatch.yml no longer exists at that ref.
  Remediation: Either keep reusable-dispatch.yml as a thin wrapper that calls the new dispatch.yml, or coordinate a forced upgrade of all non-vendored installs before moving the v0 tag.

• [stale-reference] AGENTS.md:32 — Stale developer guidance referencing reusable-dispatch.yml. Line 32 instructs developers to keep routing logic in sync between dispatch.yml (scaffold) and reusable-dispatch.yml (repo). After this PR, the repo file is dispatch.yml, not reusable-dispatch.yml. Incorrect AGENTS.md instructions will confuse contributors and AI agents.
  Remediation: Update AGENTS.md line 32 to reference .github/workflows/dispatch.yml and clarify the new relationship.

• [stale-workflow-reference] docs/plans/automatic-updates.md:12 — References the old workflow file reusable-dispatch.yml at lines 12, 30, 112–118, 126, 150. These stale references remain after merge.
  Remediation: Update references from reusable-dispatch.yml to dispatch.yml.

• [stale-workflow-reference] docs/guides/dev/testing-workflows.md:64 — Testing guide references reusable-dispatch.yml@<YOUR_BRANCH>. Following these instructions will fail after this PR merges.
  Remediation: Update line 64 to reference dispatch.yml.

Medium

• [missing-authorization] — This PR implements a non-trivial structural change (1160 lines added, workflow deletion/creation, test updates across 8 files) but has no linked issue. The PR body references ADR Review multi-agent trap article for insights #62, which documents the accepted decision, but no issue URL is provided for authorization tracking.

• [stale-workflow-reference] docs/ADRs/0033-per-repo-installation-mode.md — ADR 33 references reusable-dispatch.yml extensively as a key architectural artifact. Add a brief annotation noting the rename per ADR 62.

• [stale-workflow-reference] docs/ADRs/0062-dispatch-version-skew.md:53 — ADR 62 references reusable-dispatch.yml throughout, but the implementation renames the file to dispatch.yml. The consequences section references a filename that no longer exists.

• [stale-workflow-reference] docs/plans/merge-stage-workflows.md:55 — Implementation plan's "Files changed" table says .github/workflows/reusable-dispatch.yml | Modify but the actual implementation renames the file.

• [stale-workflow-reference] docs/architecture.md:49 — Living architecture document references reusable-dispatch.yml. This document "must always reflect the current state of architectural decisions."

---

Labels: PR modifies dispatch workflow infrastructure (.github/workflows/dispatch.yml) and Go scaffold code (internal/scaffold/).

Previous run (9)

Review

Findings

High

• [logic-error] .github/workflows/reusable-dispatch.yml — The inlined code and fix jobs omit git config --global user.email and git config --global user.name from the "Resolve bot identity" step. The standalone reusable-code.yml (lines 173–174) and reusable-fix.yml (lines 163–164) both set these after exporting GIT_BOT_EMAIL to GITHUB_ENV. Without these config lines, commits created by the code or fix agents will use the runner's default identity instead of the minted bot identity, affecting commit attribution and potentially breaking downstream logic that checks commit author.
  Remediation: Add git config --global user.email "${GIT_BOT_EMAIL}" and git config --global user.name "${BOT_LOGIN}" to the "Resolve bot identity" step in both the inlined code job (after the echo "GIT_BOT_EMAIL=..." line, around line 307) and the inlined fix job (around line 530).

Medium

• [protected-path] .github/actions/prepare-workspace/action.yml, .github/workflows/reusable-dispatch.yml — PR modifies files under the .github/ protected path. The PR links to issue Implement ADR 62: inline stage workflows into reusable-dispatch.yml #2884 and references ADR Review multi-agent trap article for insights #62, providing sufficient context for the change. Human approval is always required for protected-path changes, regardless of authorization context.

Low

• [logic-discrepancy] .github/workflows/reusable-dispatch.yml — The "Checkout upstream defaults" step in all inlined jobs uses hashFiles('.defaults/action.yml') == '', while the standalone reusable-{stage}.yml files check hashFiles('.defaults/action.yml', '.fullsend/.defaults/action.yml') == ''. Since all subsequent steps reference .defaults/ (not .fullsend/.defaults/), the inlined version's single-path check is functionally correct and arguably better. Noting for awareness only.

• [GHA workflow command injection] .github/workflows/reusable-dispatch.yml — Two pre-existing instances where values are interpolated into ::warning:: and ::error:: workflow commands without sanitization (line ~132: API error output; line ~398: repo full names in fork detection). Exploitation is very unlikely because the inputs are GitHub-controlled (usernames are alphanumeric+hyphens, repo names follow owner/name format, API errors are structured JSON).

Previous run (10)

Review

Findings

High

• [logic-error] .github/workflows/reusable-dispatch.yml — The inlined code and fix jobs omit git config --global user.email and git config --global user.name from the "Resolve bot identity" step. The standalone reusable-code.yml (lines 173–174) and reusable-fix.yml (lines 163–164) both include these lines after exporting GIT_BOT_EMAIL to GITHUB_ENV. The post-scripts (post-code.sh, post-fix.sh) call git commit --amend --no-edit, which relies on the global git config for author/committer identity. Without these config lines, commits will use the runner's default git identity instead of the bot identity.
  Remediation: Add git config --global user.email "${GIT_BOT_EMAIL}" and git config --global user.name "${BOT_LOGIN}" to the "Resolve bot identity" step in both the inlined code job (after line ~308) and the inlined fix job (after line ~530).

Medium

• [logic-error] .github/workflows/reusable-dispatch.yml — The hashFiles condition in the "Checkout upstream defaults" step of all six inlined jobs checks only hashFiles('.defaults/action.yml'), while all standalone reusable-*.yml files check hashFiles('.defaults/action.yml', '.fullsend/.defaults/action.yml'). The second path is the vendored marker for per-repo installs. In per-repo vendored installs, the marker exists at .fullsend/.defaults/action.yml but not .defaults/action.yml, so the checkout step will unnecessarily run and overwrite the vendored content.
  Remediation: Change the if condition on all six "Checkout upstream defaults" steps to hashFiles('.defaults/action.yml', '.fullsend/.defaults/action.yml') == ''.

• [protected-path] .github/actions/prepare-workspace/action.yml, .github/workflows/reusable-dispatch.yml — PR modifies files under the .github/ protected path. The PR links to issue Implement ADR 62: inline stage workflows into reusable-dispatch.yml #2884 and references ADR Review multi-agent trap article for insights #62, providing sufficient context for the change. Human approval is always required for protected-path changes, regardless of authorization context.

• [step-duplication-vs-action] .github/workflows/reusable-dispatch.yml — The "Prepare workspace" logic now exists in two forms: the new composite action (used by inlined jobs in reusable-dispatch.yml) and inline bash scripts (in standalone reusable-{stage}.yml files kept for per-org mode). This creates a maintenance burden where workspace setup changes must be made in two places until per-org mode is removed (ADR 44).

Previous run

Review

Findings

High

• [logic-error] internal/scaffold/workflow_call_alignment_test.go — TestRoleCheckCaseBranches has double-prefix typo: loadRepoFile(".github/workflows/reusable-reusable-dispatch.yml") and loadScaffoldFile(".github/workflows/reusable-reusable-dispatch.yml"). Neither file exists. loadRepoFile reads from the repo root (../../path) where the file is .github/workflows/reusable-dispatch.yml. loadScaffoldFile reads from the embedded scaffold via FullsendRepoFile where the file is .github/workflows/dispatch.yml. Both test cases will fail with file-not-found errors.
  Remediation: Fix loadRepoFile path to .github/workflows/reusable-dispatch.yml and loadScaffoldFile path to .github/workflows/dispatch.yml.

• [logic-error] internal/scaffold/scaffold_test.go — Multiple tests changed to reference reusable-dispatch.yml instead of dispatch.yml in the scaffold, but the scaffold file at internal/scaffold/fullsend-repo/.github/workflows/dispatch.yml is NOT renamed in this PR. FullsendRepoFile reads from the embed.FS which only contains dispatch.yml. Affected tests: TestFullsendRepoFilesExist (expects reusable-dispatch.yml in file list), TestShimWorkflowCallTemplateContent (asserts reusable-dispatch.yml@main in rendered output), and TestDispatchWorkflowContent (calls FullsendRepoFile(".github/workflows/reusable-dispatch.yml")). All three will fail.
  Remediation: Either rename the scaffold file from dispatch.yml to reusable-dispatch.yml and include the rename in this PR, or revert these test changes to use dispatch.yml. Since dispatch.yml is the per-org scaffold workflow (distinct from the repo's reusable-dispatch.yml for per-repo mode), reverting is likely correct.

Medium

• [protected-path] .github/actions/prepare-workspace/action.yml, .github/workflows/reusable-dispatch.yml — PR modifies files under the .github/ protected path. The PR links to issue Implement ADR 62: inline stage workflows into reusable-dispatch.yml #2884 and references ADR Review multi-agent trap article for insights #62, providing sufficient context for the change. Human approval is always required for protected-path changes, regardless of authorization context.

Previous run

Review

Findings

High

• [stale-reference] .github/workflows/dispatch.yml — The PR renames reusable-dispatch.yml to dispatch.yml and deletes the old file. Existing non-vendored per-repo installations have shims with uses: fullsend-ai/fullsend/.github/workflows/reusable-dispatch.yml@v0. When the v0 tag is moved to include this commit, those shims will fail because reusable-dispatch.yml no longer exists at that ref.
  Remediation: Either keep reusable-dispatch.yml as a thin wrapper that calls the new dispatch.yml, or coordinate a forced upgrade of all non-vendored installs before moving the v0 tag.

• [stale-reference] AGENTS.md:32 — Stale developer guidance referencing reusable-dispatch.yml. Line 32 instructs developers to keep routing logic in sync between dispatch.yml (scaffold) and reusable-dispatch.yml (repo). After this PR, the repo file is dispatch.yml, not reusable-dispatch.yml. Incorrect AGENTS.md instructions will confuse contributors and AI agents.
  Remediation: Update AGENTS.md line 32 to reference .github/workflows/dispatch.yml and clarify the new relationship.

• [stale-workflow-reference] docs/plans/automatic-updates.md:12 — References the old workflow file reusable-dispatch.yml at lines 12, 30, 112–118, 126, 150. These stale references remain after merge.
  Remediation: Update references from reusable-dispatch.yml to dispatch.yml.

• [stale-workflow-reference] docs/guides/dev/testing-workflows.md:64 — Testing guide references reusable-dispatch.yml@<YOUR_BRANCH>. Following these instructions will fail after this PR merges.
  Remediation: Update line 64 to reference dispatch.yml.

Medium

• [missing-authorization] — This PR implements a non-trivial structural change (1160 lines added, workflow deletion/creation, test updates across 8 files) but has no linked issue. The PR body references ADR Review multi-agent trap article for insights #62, which documents the accepted decision, but no issue URL is provided for authorization tracking.

• [stale-workflow-reference] docs/ADRs/0033-per-repo-installation-mode.md — ADR 33 references reusable-dispatch.yml extensively as a key architectural artifact. Add a brief annotation noting the rename per ADR 62.

• [stale-workflow-reference] docs/ADRs/0062-dispatch-version-skew.md:53 — ADR 62 references reusable-dispatch.yml throughout, but the implementation renames the file to dispatch.yml. The consequences section references a filename that no longer exists.

• [stale-workflow-reference] docs/plans/merge-stage-workflows.md:55 — Implementation plan's "Files changed" table says .github/workflows/reusable-dispatch.yml | Modify but the actual implementation renames the file.

• [stale-workflow-reference] docs/architecture.md:49 — Living architecture document references reusable-dispatch.yml. This document "must always reflect the current state of architectural decisions."

---

Labels: PR modifies dispatch workflow infrastructure (.github/workflows/dispatch.yml) and Go scaffold code (internal/scaffold/).

Previous run (11)

Review

Findings

High

• [logic-error] .github/workflows/reusable-dispatch.yml — The inlined code and fix jobs omit git config --global user.email and git config --global user.name from the "Resolve bot identity" step. The standalone reusable-code.yml (lines 173–174) and reusable-fix.yml (lines 163–164) both include these lines after exporting GIT_BOT_EMAIL to GITHUB_ENV. The post-scripts (post-code.sh, post-fix.sh) call git commit --amend --no-edit, which relies on the global git config for author/committer identity. Without these config lines, commits will use the runner's default git identity instead of the bot identity.
  Remediation: Add git config --global user.email "${GIT_BOT_EMAIL}" and git config --global user.name "${BOT_LOGIN}" to the "Resolve bot identity" step in both the inlined code job (after line ~308) and the inlined fix job (after line ~530).

Medium

• [logic-error] .github/workflows/reusable-dispatch.yml — The hashFiles condition in the "Checkout upstream defaults" step of all six inlined jobs checks only hashFiles('.defaults/action.yml'), while all standalone reusable-*.yml files check hashFiles('.defaults/action.yml', '.fullsend/.defaults/action.yml'). The second path is the vendored marker for per-repo installs. In per-repo vendored installs, the marker exists at .fullsend/.defaults/action.yml but not .defaults/action.yml, so the checkout step will unnecessarily run and overwrite the vendored content.
  Remediation: Change the if condition on all six "Checkout upstream defaults" steps to hashFiles('.defaults/action.yml', '.fullsend/.defaults/action.yml') == ''.

• [protected-path] .github/actions/prepare-workspace/action.yml, .github/workflows/reusable-dispatch.yml — PR modifies files under the .github/ protected path. The PR links to issue Implement ADR 62: inline stage workflows into reusable-dispatch.yml #2884 and references ADR Review multi-agent trap article for insights #62, providing sufficient context for the change. Human approval is always required for protected-path changes, regardless of authorization context.

• [step-duplication-vs-action] .github/workflows/reusable-dispatch.yml — The "Prepare workspace" logic now exists in two forms: the new composite action (used by inlined jobs in reusable-dispatch.yml) and inline bash scripts (in standalone reusable-{stage}.yml files kept for per-org mode). This creates a maintenance burden where workspace setup changes must be made in two places until per-org mode is removed (ADR 44).

[fullsend-ai-review]

🤖 Review · ⚠️ Cancelled · Started 1:41 PM UTC · Ended 1:46 PM UTC
Commit: 9f4f2b6 · View workflow run →

[fullsend-ai-review]

🤖 Review · ⚠️ Cancelled · Started 1:47 PM UTC · Ended 1:51 PM UTC
Commit: 9f4f2b6 · View workflow run →

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 1:52 PM UTC · Completed 2:08 PM UTC
Commit: 8a3d592 · View workflow run →

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 2:41 PM UTC · Completed 2:56 PM UTC
Commit: aceae2b · View workflow run →

[fullsend-ai-review]

🤖 Finished Review · ❌ Failure · Started 3:27 PM UTC · Completed 3:42 PM UTC
Commit: fffe08d · View workflow run →

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 7:53 AM UTC · Completed 8:04 AM UTC
Commit: d6537ed · View workflow run →

[fullsend-ai-review]

🤖 Review · ❌ Terminated · Started 12:14 PM UTC · Ended 12:28 PM UTC
Commit: 5cd495a · View workflow run →

[rh-hemartin]

Tested this last version on my repository, works well.

Superseded by updated review

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 12:14 PM UTC · Completed 12:28 PM UTC
Commit: f303051 · View workflow run →

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 6:05 AM UTC · Completed 6:15 AM UTC
Commit: f3a3868 · View workflow run →

[fullsend-ai-review]

See the review comment for full details.