fix(#3036): resolve prepare-sandbox script path for per-repo installs

[ifireball]

Summary

• Add optional fullsend-dir input to the setup-gcp composite action and resolve prepare-sandbox-credentials.sh relative to that directory (.fullsend/scripts/… in per-repo mode, scripts/… in per-org mode).
• Pass fullsend-dir from all six reusable agent workflows, matching the existing Run agent step.

Fixes #3036 — per-repo agent runs were failing at Setup GCP and prepare credentials with exit 127 after #3000 moved scaffold scripts under .fullsend/.

Test plan

• actionlint passes on changed workflow and action files
• Behaviour CI on ci(e2e): add Gherkin behaviour tests with dummy runtime #1982 (or manual per-repo triage run) completes Setup GCP and prepare credentials successfully
• Per-org agent runs unchanged (fullsend-dir empty → scripts/prepare-sandbox-credentials.sh)

Made with Cursor

[qodo-code-review]

PR Summary by Qodo

Fix setup-gcp credential prep path for per-repo installs

🐞 Bug fix ⚙️ Configuration changes 🕐 10-20 Minutes

AI Description

• Add fullsend-dir input to setup-gcp and run credential prep relative to it.
• Pass fullsend-dir from all reusable agent workflows for per-repo .fullsend/ layouts.
• Keep per-org runs unchanged by defaulting to the workspace-root scripts/ path.

Diagram

graph TD
  W["Reusable agent workflow"] --> D{"install_mode?"} --> R["per-repo: .fullsend"] --> I["fullsend-dir input"] --> A[["setup-gcp action"]] --> S["prepare-sandbox-credentials.sh"]
  D --> O["per-org: empty"] --> I

  subgraph Legend
    direction LR
    _wf["Workflow"] ~~~ _dec{"Decision"} ~~~ _act[["Composite action"]]
  end

Loading

High-Level Assessment

The following are alternative approaches to this PR:

1. Auto-detect .fullsend/ inside setup-gcp

• ➕ No need to plumb fullsend-dir through every caller workflow
• ➕ More robust for new workflows that forget to pass the input
• ➖ Heuristics can be ambiguous if both layouts exist or paths differ
• ➖ Harder to reason about behavior than an explicit input

2. Duplicate credential-prep step per install_mode in workflows

• ➕ Keeps setup-gcp action simpler (no extra input/env)
• ➕ Explicitly shows the two script paths in workflows
• ➖ Repeats logic across multiple workflows and increases drift risk
• ➖ Makes adding new workflows more error-prone

Recommendation: The PR’s approach (explicit fullsend-dir input) is a good tradeoff: it keeps path resolution centralized in the composite action while making the layout decision explicit at the workflow level. Auto-detection is tempting but risks brittle heuristics; duplicating steps would create long-term maintenance drift across the reusable workflows.

Files changed (7) +13 / -1

Bug fix (1) +7 / -1

action.ymlAdd fullsend-dir input and resolve credential script path +7/-1

Add fullsend-dir input and resolve credential script path

• Adds an optional 'fullsend-dir' input and exports it as 'FULLSEND_DIR' for the credential prep step. Updates the script invocation to prefix the path with '${FULLSEND_DIR}/' when provided, preserving the prior workspace-root behavior when empty.

.github/actions/setup-gcp/action.yml

Other (6) +6 / -0

reusable-code.ymlPass fullsend-dir to setup-gcp based on install_mode +1/-0

Pass fullsend-dir to setup-gcp based on install_mode

• Computes 'fullsend-dir' as '.fullsend' for 'per-repo' installs and empty string otherwise. Passes the value into the 'setup-gcp' composite action to align script layout with the install mode.

.github/workflows/reusable-code.yml

reusable-fix.ymlPass fullsend-dir to setup-gcp based on install_mode +1/-0

Pass fullsend-dir to setup-gcp based on install_mode

• Adds 'fullsend-dir' to the 'setup-gcp' invocation, selecting '.fullsend' for per-repo mode and empty for per-org mode. Prevents credential setup from failing due to a moved script location.

.github/workflows/reusable-fix.yml

reusable-prioritize.ymlPass fullsend-dir to setup-gcp based on install_mode +1/-0

Pass fullsend-dir to setup-gcp based on install_mode

• Updates the workflow to provide 'fullsend-dir' to 'setup-gcp' so the credential-prep script is resolved under '.fullsend/' in per-repo runs and under 'scripts/' in per-org runs.

.github/workflows/reusable-prioritize.yml

reusable-retro.ymlPass fullsend-dir to setup-gcp based on install_mode +1/-0

Pass fullsend-dir to setup-gcp based on install_mode

• Plumbs 'fullsend-dir' into the 'setup-gcp' step, derived from 'install_mode'. This keeps retro runs compatible with both per-repo and per-org directory layouts.

.github/workflows/reusable-retro.yml

reusable-review.ymlPass fullsend-dir to setup-gcp based on install_mode +1/-0

Pass fullsend-dir to setup-gcp based on install_mode

• Adds 'fullsend-dir' to the 'setup-gcp' call, using '.fullsend' when running in per-repo mode. Ensures the prepare-credentials script path matches the post-#3000 scaffold layout.

.github/workflows/reusable-review.yml

reusable-triage.ymlPass fullsend-dir to setup-gcp based on install_mode +1/-0

Pass fullsend-dir to setup-gcp based on install_mode

• Updates triage workflow to pass 'fullsend-dir' into 'setup-gcp', computed from 'install_mode'. Fixes per-repo triage failures where the script was looked up at the workspace root.

.github/workflows/reusable-triage.yml

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 4:18 AM UTC · Completed 4:26 AM UTC
Commit: fe2140e · View workflow run →

[github-actions]

Site preview

Preview: https://06a2df95-site.fullsend-ai.workers.dev

Commit: fe2140e8dfae9ea18095f3b724ee87c43fff738b

[qodo-code-review]

Code Review by Qodo

🐞 Bugs (0) 📘 Rule violations (0) 📎 Requirement gaps (0)

Great, no issues found!

Qodo reviewed your code and found no material issues that require review

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[fullsend-ai-review]

Review

Findings

Medium

• [protected-path] .github/actions/setup-gcp/action.yml, .github/workflows/reusable-{code,fix,prioritize,retro,review,triage}.yml — All 7 changed files are under .github/, a protected path requiring human approval. The PR links to issue setup-gcp action uses scripts/ path that breaks per-repo installs after #3000 #3036 and explains the rationale (per-repo agent runs failing with exit 127 after fix: load per-repo config.yaml in fullsend run and reusable workflows #3000 moved scaffold scripts under .fullsend/). Human approval is required for protected-path changes regardless of context.

Low

• [naming-conventions] .github/actions/setup-gcp/action.yml:11 — The new fullsend-dir input uses kebab-case, inconsistent with existing inputs in the same action (gcp_wif_provider, gcp_project_id) which use snake_case. Consider renaming to fullsend_dir for consistency.

---

Labels: All changes are CI workflow files (.github/) fixing a per-repo install path resolution bug.

[ifireball]

Consolidated into #3039 — one PR with consistent fullsend-dir path resolution for setup-gcp and inline pre-scripts.

[fullsend-ai-retro]

🤖 Finished Retro · ✅ Success · Started 4:42 AM UTC · Completed 4:50 AM UTC
Commit: fe2140e · View workflow run →

[fullsend-ai-retro]

PR #3037 was a manually-authored bug fix for per-repo script path resolution after #3000 moved scaffold scripts under .fullsend/. The code agent failed on issue #3036 — it correctly identified and edited the right files but never wrote the required output/code-result.json artifact in either iteration, forcing human intervention. The PR was closed without merge and consolidated into #3039 (which also fixes #3038). The review agent correctly flagged protected-path and a naming convention inconsistency. No human reviews were submitted before closure, limiting autonomy-readiness analysis. Two actionable improvements identified: hardening code agent output compliance and adding regression prevention for per-repo script path references.

Proposals filed

• Code agent should write output artifact before committing code changes (in fullsend-ai/fullsend)
• Add CI lint to catch hardcoded script paths that break per-repo install mode (in fullsend-ai/fullsend)