Skip to content

fix(#4718): stop running pre-code/pre-fix scripts twice per run - #4762

Closed
waynesun09 wants to merge 3 commits into
mainfrom
fix-4718-dedupe-pre-scripts
Closed

fix(#4718): stop running pre-code/pre-fix scripts twice per run#4762
waynesun09 wants to merge 3 commits into
mainfrom
fix-4718-dedupe-pre-scripts

Conversation

@waynesun09

Copy link
Copy Markdown
Member

Summary

pre-code.sh and pre-fix.sh each ran twice per agent invocation — once inline in the reusable workflow, once again as the harness pre_script inside fullsend run. This removes the duplication: for fix, by deleting the now-redundant inline step; for code, by gating the expensive/side-effecting part of the duplicated work behind a new env var, since the inline call there can't simply be deleted (its skipped= output gates four downstream steps that all run before fullsend run is invoked).

Related Issue

Fixes #4718

Changes

  • .github/workflows/reusable-fix.yml — delete the inline "Validate inputs" step. Nothing in this workflow reads its outputs (unlike the code flow); pre-fix.sh continues to run exactly once, as the harness pre_script. PR_NUMBER/REPO_FULL_NAME/TRIGGER_SOURCE/HUMAN_INSTRUCTION/FIX_ITERATION are already wired into that invocation via harness/fix.yaml's env.runner/forge.github.env.runner.
  • internal/scaffold/fullsend-repo/scripts/pre-code.sh — wrap the existing-human-PR check (the GH API search + pr-open label + issue comment) behind a new CODE_SKIP_EXISTING_PR_CHECK env var. Unset (the default, used by the inline workflow step) preserves today's behavior exactly. Input validation and the pre-commit tool auto-install are unaffected and continue to run in both invocations.
  • internal/scaffold/fullsend-repo/harness/code.yaml — set CODE_SKIP_EXISTING_PR_CHECK: "true" in forge.github.runner_env, so only the second (harness pre_script) invocation of pre-code.sh skips the already-performed check. .github/workflows/reusable-code.yml is unchanged — its inline "Validate inputs" step is still the one that performs the check and produces the skipped= output that gates GCP setup, bot-identity resolution, agent-env setup, and the agent run itself.
  • internal/scaffold/fullsend-repo/scripts/pre-code-test.sh — add coverage for the new flag: bypasses the PR search/label/comment when set, doesn't touch GITHUB_OUTPUT, and existing behavior is byte-for-byte unchanged when unset.

Testing

  • make lint passes (staged changes)
  • Tests added/updated for new or modified logic — make script-test passes (pre-code-test.sh 26/26, including 4 new cases for CODE_SKIP_EXISTING_PR_CHECK)
  • Note: pre-fetch-prior-review-test.sh fails locally on macOS (grep -P unsupported by BSD grep) — confirmed pre-existing on main before this change, unrelated to this PR.

Checklist

  • PR title follows Conventional Commits (correct type, ! for breaking changes)
  • Commits are signed off (DCO) — human and human-directed agent sessions only
  • I wrote this contribution myself and can explain all changes in it

reusable-code.yml's inline "Validate inputs" step and pre-fix.sh's
equivalent both duplicated the harness pre_script that `fullsend run`
already executes right before sandbox creation.

For fix, the inline call had no consumer for its output — deleted it;
pre-fix.sh continues to run exactly once, as the harness pre_script.

For code, the inline call's skipped= output gates four downstream
steps (GCP setup, bot identity, agent env, the agent run itself) that
all run before `fullsend run` is invoked, so the inline call can't be
deleted outright without losing that gate. Instead, gate the
existing-human-PR search/label/comment side effects behind a new
CODE_SKIP_EXISTING_PR_CHECK env var, set only in harness/code.yaml's
forge.github.runner_env — so the second (harness pre_script)
invocation skips straight past the GH API search it already ran once,
inline, while leaving that inline invocation's behavior (and skipped=
output) completely unchanged.

Assisted-by: Claude
Signed-off-by: Wayne Sun <gsun@redhat.com>
@waynesun09
waynesun09 requested a review from a team as a code owner July 14, 2026 12:07
@fullsend-ai-review

fullsend-ai-review Bot commented Jul 14, 2026

Copy link
Copy Markdown

🤖 Finished Review · ✅ Success · Started 12:08 PM UTC · Completed 12:27 PM UTC
Commit: 089dcb2 · View workflow run →

@qodo-code-review

Copy link
Copy Markdown

PR Summary by Qodo

Deduplicate pre-code/pre-fix workflow scripts to run once per agent invocation

🐞 Bug fix 🧪 Tests ⚙️ Configuration changes 🕐 40+ Minutes

Grey Divider

AI Description

• Remove redundant pre-fix.sh inline workflow step; keep single harness pre_script execution.
• Add CODE_SKIP_EXISTING_PR_CHECK to avoid repeating pre-code.sh side effects in harness.
• Extend pre-code script tests to cover the new skip flag and output behavior.
Diagram

graph TD
  wf_code["reusable-code.yml"] --> validate["Inline validate"] --> pre_inline("pre-code.sh (gate)") --> fullsend["fullsend run"] --> pre_harness("pre-code.sh (pre_script)")
  wf_fix["reusable-fix.yml"] --> fullsend["fullsend run"] --> pre_fix("pre-fix.sh (pre_script)")
  harness[["harness/code.yaml"]] -->|"CODE_SKIP_EXISTING_PR_CHECK=true"| pre_harness

  subgraph Legend
    direction LR
    _wf["Workflow"] ~~~ _script("Script") ~~~ _cfg[["Config"]]
  end
Loading
High-Level Assessment

The following are alternative approaches to this PR:

1. Split pre-code.sh into two scripts (gate vs pre_script)
  • ➕ Avoids introducing a control flag and keeps each script single-purpose
  • ➕ Makes it harder for future callers to accidentally run side effects twice
  • ➖ Requires workflow + harness refactor and careful renaming/wiring
  • ➖ More files/entrypoints to maintain and document
2. Change workflow gating to not require running pre-code.sh inline
  • ➕ Eliminates the need for a duplicated pre-code.sh call entirely
  • ➕ Keeps all behavior centralized in the harness execution path
  • ➖ Non-trivial because skipped= currently gates multiple steps that run before fullsend run
  • ➖ May require reworking step ordering or implementing gating via a different mechanism (e.g., GH action/composite action)

Recommendation: Current approach is pragmatic: remove the fix duplication outright, and for code preserve the existing inline gate (needed for skipped=) while skipping only the expensive/side-effecting existing-PR check in the harness invocation. The env-flag is a small, well-targeted compatibility mechanism, and the added tests reduce regression risk.

Files changed (4) +175 / -64

Bug fix (2) +81 / -64
reusable-fix.ymlRemove duplicate pre-fix.sh inline validation step +8/-9

Remove duplicate pre-fix.sh inline validation step

• Deletes the inline "Validate inputs" step that ran pre-fix.sh redundantly. Adds comments clarifying that input validation now runs once via the harness pre_script during the fix agent run.

.github/workflows/reusable-fix.yml

pre-code.shGate existing-human-PR side effects behind CODE_SKIP_EXISTING_PR_CHECK +73/-55

Gate existing-human-PR side effects behind CODE_SKIP_EXISTING_PR_CHECK

• Adds documentation and a new env var that bypasses the existing-PR search/label/comment block when set to true. Default behavior remains unchanged for the inline workflow invocation, including writing skipped= for downstream gating.

internal/scaffold/fullsend-repo/scripts/pre-code.sh

Tests (1) +88 / -0
pre-code-test.shAdd tests for CODE_SKIP_EXISTING_PR_CHECK behavior +88/-0

Add tests for CODE_SKIP_EXISTING_PR_CHECK behavior

• Introduces new test cases ensuring the skip flag bypasses the existing-human-PR search/label/comment logic, does not write skipped= to GITHUB_OUTPUT in that mode, and preserves default behavior when unset.

internal/scaffold/fullsend-repo/scripts/pre-code-test.sh

Other (1) +6 / -0
code.yamlSet CODE_SKIP_EXISTING_PR_CHECK for harness pre_script invocation +6/-0

Set CODE_SKIP_EXISTING_PR_CHECK for harness pre_script invocation

• Adds CODE_SKIP_EXISTING_PR_CHECK=true to the runner environment so the harness-triggered pre-code.sh invocation skips the already-performed existing-PR side effects. Documents why the inline workflow gate still runs the full check.

internal/scaffold/fullsend-repo/harness/code.yaml

Comment thread .github/workflows/reusable-fix.yml Outdated
Comment on lines +369 to +376
# Input validation (PR_NUMBER/REPO_FULL_NAME/TRIGGER_SOURCE format,
# instruction length cap, iteration cap) runs once, as the harness
# pre_script inside "Run fix agent" below (harness/fix.yaml declares
# pre_script: scripts/pre-fix.sh, with PR_NUMBER/REPO_FULL_NAME/
# TRIGGER_SOURCE/HUMAN_INSTRUCTION/FIX_ITERATION already wired through
# its runner_env). A duplicate inline call here previously ran the
# exact same script a second time for no consumer (issue #4718) —
# unlike the code-agent flow, nothing here gates on its output.

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I don't think the comment is really necessary, we don't need to keep history of every piece that was at some place.

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Fair — turned out that spot needed to be a real step again anyway (see below), so the comment is moot now; replaced it with the re-added "Validate inputs" step in adbe187.

@rh-hemartin

Copy link
Copy Markdown
Member

I think you are introducing a feature here with the env var, could you double check that is intended to be here? In that case I disagree.

@codecov

codecov Bot commented Jul 14, 2026

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

@qodo-code-review

qodo-code-review Bot commented Jul 14, 2026

Copy link
Copy Markdown

Code Review by Qodo

🐞 Bugs (0) 📘 Rule violations (0) 📎 Requirement gaps (1) 📜 Skill insights (0)

Context used
✅ Compliance rules (platform): 61 rules

Grey Divider


Informational

1. Delayed fix input validation ✓ Resolved 🐞 Bug ☼ Reliability
Description
reusable-fix.yml removed the inline pre-fix.sh run, so instruction length and iteration-cap
checks now occur only inside Run fix agent (harness pre_script) after GCP setup and
setup-agent-env have already run, causing avoidable privileged/expensive setup on runs that should
fail fast.
Code

.github/workflows/reusable-fix.yml[R369-379]

+      # Input validation (PR_NUMBER/REPO_FULL_NAME/TRIGGER_SOURCE format,
+      # instruction length cap, iteration cap) runs once, as the harness
+      # pre_script inside "Run fix agent" below (harness/fix.yaml declares
+      # pre_script: scripts/pre-fix.sh, with PR_NUMBER/REPO_FULL_NAME/
+      # TRIGGER_SOURCE/HUMAN_INSTRUCTION/FIX_ITERATION already wired through
+      # its runner_env). A duplicate inline call here previously ran the
+      # exact same script a second time for no consumer (issue #4718) —
+      # unlike the code-agent flow, nothing here gates on its output.

      - name: Setup GCP and prepare credentials
        uses: ./.defaults/.github/actions/setup-gcp
Relevance

⭐ Low

PR intent #4718 removes inline pre-fix; prior reusable-fix changes didn’t add extra pre-validation
before GCP setup.

PR-#1565
PR-#3039

ⓘ Recommendations generated based on similar findings in past PRs

Evidence
The workflow now explicitly omits the inline pre-fix validation step and proceeds directly into GCP
setup and agent-env setup. pre-fix.sh contains the instruction length cap and iteration cap
checks, and setup-agent-env.sh propagates FIX_HUMAN_INSTRUCTION into GITHUB_ENV, meaning
oversized/invalid inputs are handled by additional steps before the harness pre_script aborts.

.github/workflows/reusable-fix.yml[369-409]
internal/scaffold/fullsend-repo/scripts/pre-fix.sh[52-87]
internal/scaffold/fullsend-repo/.github/scripts/setup-agent-env.sh[2-22]

Agent prompt
The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
The fix reusable workflow no longer runs `scripts/pre-fix.sh` (which enforces instruction length and iteration caps) before expensive setup steps. This makes invalid inputs fail later than before, after GCP credential setup and environment preparation.

## Issue Context
`pre-fix.sh` still runs as the harness `pre_script`, but that happens only when `fullsend run` is invoked (later in the job). Previously the workflow validated and failed fast before setup steps.

## Fix Focus Areas
- .github/workflows/reusable-fix.yml[369-409]
- internal/scaffold/fullsend-repo/scripts/pre-fix.sh[52-87]

## Suggested fix approach
Choose one:
1) Reintroduce an inline validation step *before* GCP setup that runs only the lightweight validation portion (instruction length + iteration cap + basic format checks), without duplicating any expensive/side-effecting work.
2) Add an env flag to `pre-fix.sh` (similar to the code flow) to skip any undesired duplicated work, then call it inline for validation while keeping the harness call.
3) Move the instruction-length + iteration-cap checks into the earlier `Extract PR number and context` step so failure happens before setup, and keep `pre-fix.sh` as a defense-in-depth check in the harness.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools


2. pre-code.sh still double-runs 📎 Requirement gap ➹ Performance
Description
The change introduces CODE_SKIP_EXISTING_PR_CHECK specifically to alter behavior on the second
invocation of scripts/pre-code.sh, indicating the script is still executed both inline in the
workflow and again as the harness pre_script. This conflicts with the ticket-derived requirement
to avoid duplicate pre-script execution and to avoid relying on inline pre-script execution for
gating.
Code

internal/scaffold/fullsend-repo/harness/code.yaml[R66-71]

+      # reusable-code.yml's inline "Validate inputs" step already ran
+      # pre-code.sh's existing-human-PR check (GH API search + label +
+      # comment) before this pre_script invocation, to gate GCP/bot-identity/
+      # agent-env setup on its skipped= output. Don't repeat those side
+      # effects here (issue #4718).
+      CODE_SKIP_EXISTING_PR_CHECK: "true"
Relevance

⭐ Low

Repo relies on inline pre-code outputs for gating expensive steps; duplicate-run mitigated via flags
is consistent.

PR-#2373
PR-#473

ⓘ Recommendations generated based on similar findings in past PRs

Evidence
harness/code.yaml now sets CODE_SKIP_EXISTING_PR_CHECK: "true" with an explicit comment stating
the workflow already ran pre-code.sh inline, proving the design still depends on (and therefore
still performs) multiple pre-code.sh invocations. pre-code.sh also explicitly documents and
implements skipping behavior intended for the *second* invocation, and
.github/workflows/reusable-code.yml still directly runs scripts/pre-code.sh to produce
steps.validate.outputs.skipped, which the downstream expensive steps gate on.

Preserve workflow gating behavior that depends on skipped output after removing inline pre-scripts
Ensure fullsend run pre_script execution remains single-run and does not require surfacing pre-script outputs
internal/scaffold/fullsend-repo/harness/code.yaml[66-71]
internal/scaffold/fullsend-repo/scripts/pre-code.sh[12-24]
internal/scaffold/fullsend-repo/scripts/pre-code.sh[71-73]
.github/workflows/reusable-code.yml[156-168]

Agent prompt
The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
The code flow still executes `scripts/pre-code.sh` twice (inline in `.github/workflows/reusable-code.yml` and again via `fullsend run` `pre_script`). The new `CODE_SKIP_EXISTING_PR_CHECK` flag confirms/encodes this duplication instead of removing it.

## Issue Context
Ticket-derived compliance requires removing redundant inline pre-script execution and preserving gating without depending on a direct inline `pre-code.sh` run.

## Fix Focus Areas
- internal/scaffold/fullsend-repo/harness/code.yaml[66-71]
- internal/scaffold/fullsend-repo/scripts/pre-code.sh[12-24]
- internal/scaffold/fullsend-repo/scripts/pre-code.sh[71-141]
- .github/workflows/reusable-code.yml[156-168]

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools


Grey Divider

Qodo Logo

@fullsend-ai-review

fullsend-ai-review Bot commented Jul 14, 2026

Copy link
Copy Markdown

Review

Re-review of e7d15e2 (prior review: adbe187, provenance: app-verified)

Approve. The prior review's medium finding — GH_TOKEN was missing from the inline "Validate inputs" step in reusable-code.yml, silently disabling the existing-human-PR check — is resolved by the third commit (e7d15e2). The inline step now receives steps.app-token.outputs.token, the existing-PR check runs exactly where CODE_SKIP_EXISTING_PR_CHECK's comment claims it does, and all three commit messages accurately describe their purpose.

Prior findings — resolution status

Finding Severity Status
[logic-error] GH_TOKEN not set in inline Validate step → existing-PR check silently disabled Medium ResolvedGH_TOKEN: ${{ steps.app-token.outputs.token }} added in e7d15e2
[behavioral-change] exit-path semantics change in harness pre_script Low Accepted — intentional and beneficial; tool install always runs in harness context

Verification summary

Correctness: All mechanisms verified end-to-end.

  • steps.app-token (line 140, id: app-token) runs before "Validate inputs" (line 156) and produces outputs.token via the mint-token action with coder role. The GH_TOKEN env var is correctly sourced.
  • CODE_SKIP_EXISTING_PR_CHECK: producer (harness/code.yaml forge.github.runner_env) sets "true" as a string literal. Consumer (pre-code.sh) checks ${CODE_SKIP_EXISTING_PR_CHECK:-false} with safe default false. Fail-closed: any non-"true" value runs the check.
  • FIX_SKIP_TOOL_INSTALL: producer (reusable-fix.yml inline step) sets "true". Consumer (pre-fix.sh) checks identically. fix.yaml does NOT set this flag, so the harness pre_script runs tool install as intended. Fail-closed.
  • All four downstream steps in reusable-code.yml gating on steps.validate.outputs.skipped != 'true' are unaffected — the inline step (which has id: validate) still writes the output.
  • No stale references to CODE_SKIP_EXISTING_PR_CHECK or FIX_SKIP_TOOL_INSTALL elsewhere in the repo (both are new identifiers).

Security: No new token scope granted. GH_TOKEN (coder-role installation token) was already available to later steps in the same job; passing it to the inline step enables the existing-PR check to function as designed. The token is passed via the env: block (safe from expression injection) to first-party code only.

Tests: 4 new test cases in pre-code-test.sh cover skip-flag bypass, non-bypass, GITHUB_OUTPUT exclusion, and default behavior. New pre-fix-test.sh (150 lines) covers input validation, iteration caps, instruction-length cap, and FIX_SKIP_TOOL_INSTALL. No existing tests weakened. pre-fix-test.sh added to Makefile script-test target.

Execution flow (updated)

Invocation GH_TOKEN PR check (before) PR check (after) Tool install (before) Tool install (after)
Code inline step now set Skipped (no token) Runs Runs Runs
Code harness pre_script ✅ inherited Runs ❌ Skipped (flag) Runs Runs
Fix inline step n/a n/a n/a Runs ❌ Skipped (flag)
Fix harness pre_script ✅ inherited n/a n/a Runs Runs

Previous run

Review

Re-review of adbe187 (prior review: 089dcb2, provenance: app-verified)

The overall approach is sound: the fix agent flow is correct (tool install runs exactly once, in the harness pre_script), and the code agent's input validation deduplication works as intended. One medium finding from the prior review remains unresolved — the comment in code.yaml misrepresents what the inline "Validate inputs" step actually does, which causes the existing-human-PR detection feature to be silently disabled rather than deduplicated.

Findings

Medium

  • [logic-error] internal/scaffold/fullsend-repo/harness/code.yaml:66 — The 5-line comment (and corresponding text in pre-code.sh's header and its echo message) states that reusable-code.yml's inline "Validate inputs" step "already ran pre-code.sh's existing-human-PR check (GH API search + label + comment)." This is incorrect. The inline step (reusable-code.yml:156–164) does not set GH_TOKEN in its env: block — it only has ISSUE_NUMBER, REPO_FULL_NAME, GITHUB_ISSUE_URL, COMMENT_BODY, and FULLSEND_DIR. No prior step exports GH_TOKEN to GITHUB_ENV (only GIT_BOT_EMAIL is exported at line 186). pre-code.sh checks ${GH_TOKEN:-} at line 58 and exits early with skipped=false when it is empty. The inline step therefore runs input validation only — the GH API search, label application, and issue comment never execute there.

    GH_TOKEN only becomes available in the composite action's "Run fullsend" step (action.yml:307, set to ${{ inputs.github_token }}), which is where the harness pre_script inherits it. Before this PR, the harness invocation was the only invocation that actually ran the existing-PR check. With CODE_SKIP_EXISTING_PR_CHECK: "true" now preventing the harness pre_script from running it, the existing-human-PR detection (pr-open label, skip comment) is disabled entirely for the code agent — not deduplicated.

    Remediation: Either (a) add GH_TOKEN: ${{ steps.app-token.outputs.token }} to the inline "Validate inputs" step's env: block in reusable-code.yml so the check actually runs there and the comment becomes accurate, or (b) if the check is intentionally being removed, update the comments to reflect that and consider removing the now-dead code, or (c) adopt the same pattern used for pre-fix.sh — add a targeted CODE_SKIP_TOOL_INSTALL flag for the inline step (which only needs input validation) and remove CODE_SKIP_EXISTING_PR_CHECK so the harness pre_script continues running the check.

Low

  • [behavioral-change] internal/scaffold/fullsend-repo/scripts/pre-code.sh — Subtle but likely beneficial change in exit-path semantics: before this PR, when the harness pre_script found an existing human PR (with GH_TOKEN available), exit 0 at line 119 terminated the script before the tool-install section (lines 125–183). After this PR, CODE_SKIP_EXISTING_PR_CHECK=true skips the entire PR-check block with no exit 0, so the script always falls through to tool install. Since the harness treats exit 0 as success and runs the agent regardless, always reaching tool install is the more correct behavior. This change is undocumented in the PR description.

Execution flow summary

Invocation GH_TOKEN PR check (before) PR check (after) Tool install (before) Tool install (after)
Code inline step ❌ not set Skipped (exit 0) Skipped (exit 0) Never reached Never reached
Code harness pre_script ✅ inherited Runs ❌ Skipped (flag) Runs (if no exit) Always runs
Fix inline step n/a n/a n/a Runs Skipped (flag)
Fix harness pre_script ✅ inherited n/a n/a Runs Runs

Labels: PR modifies CI workflow files and harness configuration for code and fix agents

Previous run

Review

Findings

Medium

  • [logic-error] internal/scaffold/fullsend-repo/harness/code.yaml:68 — The comment states that the inline "Validate inputs" step in reusable-code.yml already ran pre-code.sh's existing-human-PR check (GH API search + label + comment). This is incorrect. The inline step (reusable-code.yml:156–164) does not set GH_TOKEN in its env block, and no prior step exports GH_TOKEN to GITHUB_ENV. pre-code.sh checks ${GH_TOKEN:-} at line 58 and exits early ("GH_TOKEN not set — skipping existing-PR check") when it is empty. Although GITHUB_TOKEN is available in the runner environment, the script's guard tests GH_TOKEN specifically. The inline step therefore runs input format validation but never executes the PR search, label application, or comment posting. With CODE_SKIP_EXISTING_PR_CHECK=true now preventing the harness pre_script from running the check either, the existing-human-PR detection (pr-open label, skip comment) is silently disabled for the code agent entirely.
    Remediation: Either (a) pass GH_TOKEN to the inline "Validate inputs" step in reusable-code.yml so the PR check actually runs there and the comment becomes accurate, or (b) correct the comment to reflect the actual behavior and accept that the existing-PR check side effects are intentionally removed.

  • [protected-path] .github/workflows/reusable-fix.yml — This file is under the .github/ protected path. The PR links to issue Remove redundant pre-code.sh / pre-fix.sh calls from reusable workflows #4718 and the description explains the rationale for the change. Human approval is always required for protected-path changes, regardless of context.

Low

  • [comment-formatting] .github/workflows/reusable-fix.yml:369 — The 7-line inline comment replacing the removed "Validate inputs" step is verbose for a workflow file. Existing workflow comments are shorter and relegate detail to linked issues.
    Remediation: Condense to 1–2 lines, e.g.: # Input validation runs in harness pre_script (see scripts/pre-fix.sh and issue #4718)

  • [undocumented-config-variable] docs/agents/code.md — New environment variable CODE_SKIP_EXISTING_PR_CHECK is introduced in code.yaml but docs/agents/code.md lists "None" under Variables. This is an internal variable set by the harness itself, not a user-facing config knob, so the documentation gap is minor.

  • [comment-formatting] internal/scaffold/fullsend-repo/harness/code.yaml:66 — 5-line inline comment in YAML runner_env section is verbose compared to other harness files, which use minimal or no inline comments in their env sections. Note that the comment content is also factually incorrect per the logic-error finding above.
    Remediation: Condense to 1–2 lines, e.g.: # Skips duplicate existing-PR check (issue #4718)


Protected paths detected — this PR modifies files under one or more
protected paths. The review agent cannot approve PRs that touch these paths.
A human reviewer must approve this PR.

Protected files in this PR:

  • .github/workflows/reusable-code.yml
  • .github/workflows/reusable-fix.yml
Previous run

Review

Re-review of adbe187 (prior review: 089dcb2, provenance: app-verified)

The overall approach is sound: the fix agent flow is correct (tool install runs exactly once, in the harness pre_script), and the code agent's input validation deduplication works as intended. One medium finding from the prior review remains unresolved — the comment in code.yaml misrepresents what the inline "Validate inputs" step actually does, which causes the existing-human-PR detection feature to be silently disabled rather than deduplicated.

Findings

Medium

  • [logic-error] internal/scaffold/fullsend-repo/harness/code.yaml:66 — The 5-line comment (and corresponding text in pre-code.sh's header and its echo message) states that reusable-code.yml's inline "Validate inputs" step "already ran pre-code.sh's existing-human-PR check (GH API search + label + comment)." This is incorrect. The inline step (reusable-code.yml:156–164) does not set GH_TOKEN in its env: block — it only has ISSUE_NUMBER, REPO_FULL_NAME, GITHUB_ISSUE_URL, COMMENT_BODY, and FULLSEND_DIR. No prior step exports GH_TOKEN to GITHUB_ENV (only GIT_BOT_EMAIL is exported at line 186). pre-code.sh checks ${GH_TOKEN:-} at line 58 and exits early with skipped=false when it is empty. The inline step therefore runs input validation only — the GH API search, label application, and issue comment never execute there.

    GH_TOKEN only becomes available in the composite action's "Run fullsend" step (action.yml:307, set to ${{ inputs.github_token }}), which is where the harness pre_script inherits it. Before this PR, the harness invocation was the only invocation that actually ran the existing-PR check. With CODE_SKIP_EXISTING_PR_CHECK: "true" now preventing the harness pre_script from running it, the existing-human-PR detection (pr-open label, skip comment) is disabled entirely for the code agent — not deduplicated.

    Remediation: Either (a) add GH_TOKEN: ${{ steps.app-token.outputs.token }} to the inline "Validate inputs" step's env: block in reusable-code.yml so the check actually runs there and the comment becomes accurate, or (b) if the check is intentionally being removed, update the comments to reflect that and consider removing the now-dead code, or (c) adopt the same pattern used for pre-fix.sh — add a targeted CODE_SKIP_TOOL_INSTALL flag for the inline step (which only needs input validation) and remove CODE_SKIP_EXISTING_PR_CHECK so the harness pre_script continues running the check.

Low

  • [behavioral-change] internal/scaffold/fullsend-repo/scripts/pre-code.sh — Subtle but likely beneficial change in exit-path semantics: before this PR, when the harness pre_script found an existing human PR (with GH_TOKEN available), exit 0 at line 119 terminated the script before the tool-install section (lines 125–183). After this PR, CODE_SKIP_EXISTING_PR_CHECK=true skips the entire PR-check block with no exit 0, so the script always falls through to tool install. Since the harness treats exit 0 as success and runs the agent regardless, always reaching tool install is the more correct behavior. This change is undocumented in the PR description.

Execution flow summary

Invocation GH_TOKEN PR check (before) PR check (after) Tool install (before) Tool install (after)
Code inline step ❌ not set Skipped (exit 0) Skipped (exit 0) Never reached Never reached
Code harness pre_script ✅ inherited Runs ❌ Skipped (flag) Runs (if no exit) Always runs
Fix inline step n/a n/a n/a Runs Skipped (flag)
Fix harness pre_script ✅ inherited n/a n/a Runs Runs

Labels: PR modifies CI workflow files and harness configuration for code and fix agents

Previous run (2)

Review

Findings

Medium

  • [logic-error] internal/scaffold/fullsend-repo/harness/code.yaml:68 — The comment states that the inline "Validate inputs" step in reusable-code.yml already ran pre-code.sh's existing-human-PR check (GH API search + label + comment). This is incorrect. The inline step (reusable-code.yml:156–164) does not set GH_TOKEN in its env block, and no prior step exports GH_TOKEN to GITHUB_ENV. pre-code.sh checks ${GH_TOKEN:-} at line 58 and exits early ("GH_TOKEN not set — skipping existing-PR check") when it is empty. Although GITHUB_TOKEN is available in the runner environment, the script's guard tests GH_TOKEN specifically. The inline step therefore runs input format validation but never executes the PR search, label application, or comment posting. With CODE_SKIP_EXISTING_PR_CHECK=true now preventing the harness pre_script from running the check either, the existing-human-PR detection (pr-open label, skip comment) is silently disabled for the code agent entirely.
    Remediation: Either (a) pass GH_TOKEN to the inline "Validate inputs" step in reusable-code.yml so the PR check actually runs there and the comment becomes accurate, or (b) correct the comment to reflect the actual behavior and accept that the existing-PR check side effects are intentionally removed.

  • [protected-path] .github/workflows/reusable-fix.yml — This file is under the .github/ protected path. The PR links to issue Remove redundant pre-code.sh / pre-fix.sh calls from reusable workflows #4718 and the description explains the rationale for the change. Human approval is always required for protected-path changes, regardless of context.

Low

  • [comment-formatting] .github/workflows/reusable-fix.yml:369 — The 7-line inline comment replacing the removed "Validate inputs" step is verbose for a workflow file. Existing workflow comments are shorter and relegate detail to linked issues.
    Remediation: Condense to 1–2 lines, e.g.: # Input validation runs in harness pre_script (see scripts/pre-fix.sh and issue #4718)

  • [undocumented-config-variable] docs/agents/code.md — New environment variable CODE_SKIP_EXISTING_PR_CHECK is introduced in code.yaml but docs/agents/code.md lists "None" under Variables. This is an internal variable set by the harness itself, not a user-facing config knob, so the documentation gap is minor.

  • [comment-formatting] internal/scaffold/fullsend-repo/harness/code.yaml:66 — 5-line inline comment in YAML runner_env section is verbose compared to other harness files, which use minimal or no inline comments in their env sections. Note that the comment content is also factually incorrect per the logic-error finding above.
    Remediation: Condense to 1–2 lines, e.g.: # Skips duplicate existing-PR check (issue #4718)

fullsend-ai-review[bot]

This comment was marked as outdated.

@fullsend-ai-review fullsend-ai-review Bot added the requires-manual-review Review requires human judgment label Jul 14, 2026
Deleting reusable-fix.yml's inline step outright (previous commit)
dropped pre-fix.sh's instruction-length/iteration-cap checks to run
only inside "Run fix agent", after GCP setup and agent-env setup —
so a capped or malformed fix request now burns that setup cost before
failing, instead of failing immediately. Flagged in PR review.

Re-add the inline step, but keep it cheap: FIX_SKIP_TOOL_INSTALL
defers the pre-commit tool auto-install to the harness pre_script
invocation (inside "Run fix agent", where the tools are actually
needed for post-fix.sh's pre-commit run), while validation and the
iteration cap still run inline for fail-fast behavior. Both
invocations still run validation — cheap and idempotent, same
tradeoff already made for the code flow.

Add pre-fix-test.sh (previously untested) covering validation,
instruction-length cap, iteration cap, and the new flag.

Assisted-by: Claude
Signed-off-by: Wayne Sun <gsun@redhat.com>
@waynesun09

Copy link
Copy Markdown
Member Author

Re: the "introducing a feature with the env var" comment — fair to question, walking through why it's there rather than just removing the inline call outright:

reusable-code.yml's four steps after "Validate inputs" (Setup GCP, Resolve bot identity, Setup agent environment, and Run code agent itself) are all gated on steps.validate.outputs.skipped, which that inline step produces. fullsend run only executes pre_script immediately before sandbox creation — inside "Run code agent", the last of those four steps. So the skipped output can't come from the harness invocation; by the time it runs, GCP/bot-identity/agent-env setup have already happened. That's what makes the inline call structurally load-bearing here, unlike the fix flow (nothing there gated on the inline step's output, so I could just delete it — see the second commit).

Given the inline call has to stay, CODE_SKIP_EXISTING_PR_CHECK is there to stop it from also being expensive twice — the GH API search + pr-open label + issue comment only run once now, on the inline call; the harness invocation skips straight past that block into the tool-install section it's actually there for. So pre-code.sh does still run twice (I don't think that's avoidable without moving GCP/bot-identity/agent-env setup to after the check, which is a much bigger change than this issue asks for), but the GH API side effects that were the actual duplication concern now happen exactly once.

If you'd rather see the two responsibilities split into separate scripts instead of toggled by an env var (e.g. a small pre-code-gate.sh for the inline step, pre-code.sh trimmed to validation + tool-install for the harness pre_script) — happy to go that direction instead if that's a cleaner shape for this codebase. Let me know which you'd prefer.

fullsend-ai-review[bot]

This comment was marked as outdated.

@fullsend-ai-review fullsend-ai-review Bot added requires-manual-review Review requires human judgment component/ci CI pipelines and checks component/harness Agent harness, config, and skills loading and removed requires-manual-review Review requires human judgment labels Jul 14, 2026
@fullsend-ai-review

Copy link
Copy Markdown

🤖 Finished Review · ✅ Success · Started 12:30 PM UTC · Completed 12:46 PM UTC
Commit: adbe187 · View workflow run →

@rh-hemartin

Copy link
Copy Markdown
Member

So changes on harnesses and scripts has no effect here. So given that the pre-code/pre-fix makes sense, I would close PR and issue and open a new one to introduce the mechanisms to avoid some work.

Also I would like to see all agents being gated this way for consistency.

The inline step never set GH_TOKEN, so pre-code.sh's GH_TOKEN guard
(added before this branch existed) always short-circuited it straight
to skipped=false — the existing-human-PR search, pr-open label, and
skip comment never actually ran there. Combined with the second
commit's CODE_SKIP_EXISTING_PR_CHECK=true on the harness invocation,
that check was running nowhere at all, silently dropping the feature.
Caught by fullsend-ai-review[bot] on this PR.

Wire GH_TOKEN from steps.app-token.outputs.token, matching how
"Resolve bot identity" already sources it, so the check runs where
CODE_SKIP_EXISTING_PR_CHECK's own comment claims it does.

Also trim the runner_env comment per review feedback (both
rh-hemartin and the review bot flagged the multi-line comments in
this diff as more history than a workflow/harness file needs).

Assisted-by: Claude
Signed-off-by: Wayne Sun <gsun@redhat.com>
@fullsend-ai-review

fullsend-ai-review Bot commented Jul 14, 2026

Copy link
Copy Markdown

🤖 Review · ❌ Terminated · Started 3:25 PM UTC · Ended 3:40 PM UTC
Commit: 5cd495a · View workflow run →

@waynesun09

Copy link
Copy Markdown
Member Author

Happy to close this and rescope — before I do, could you clarify what mechanism you're picturing?

A few things I want to make sure I understand:

  1. When you say "changes on harnesses and scripts has no effect here" — do you mean the env-var toggle approach specifically doesn't solve it for you, or that harness/script-level changes in general are the wrong layer and this needs to live in the reusable workflows themselves?
  2. "Gated this way for consistency" — gated how, concretely? E.g. a shared composite action/step that every reusable-*.yml calls before its expensive setup (GCP/bot-identity/agent-env), which internally handles both the fast validation and any skip-check, so each harness only ever declares one script that runs once? Or something else?
  3. Should this cover every agent (triage, prioritize, review, retro, scribe, code, fix), even the ones that don't currently have a duplicate-execution problem — i.e. you want the pattern standardized even where nothing's broken today, not just the two flows Remove redundant pre-code.sh / pre-fix.sh calls from reusable workflows #4718 called out?

Want to make sure whatever gets scoped into the new issue actually matches what you have in mind rather than me guessing again.

@fullsend-ai-review fullsend-ai-review Bot added requires-manual-review Review requires human judgment and removed requires-manual-review Review requires human judgment labels Jul 14, 2026
@fullsend-ai-review

Copy link
Copy Markdown

🤖 Finished Review · ✅ Success · Started 3:25 PM UTC · Completed 3:40 PM UTC
Commit: e7d15e2 · View workflow run →

@rh-hemartin

Copy link
Copy Markdown
Member

When you say "changes on harnesses and scripts has no effect here" — do you mean the env-var toggle approach specifically doesn't solve it for you, or that harness/script-level changes in general are the wrong layer and this needs to live in the reusable workflows themselves?

I mean that we moved to fullsend-ai/agents the part of harnesses, variables and agents themselves.

Happy to close this and rescope — before I do, could you clarify what mechanism you're picturing?

"Gated this way for consistency" — gated how, concretely? E.g. a shared composite action/step that every reusable-*.yml calls before its expensive setup (GCP/bot-identity/agent-env), which internally handles both the fast validation and any skip-check, so each harness only ever declares one script that runs once? Or something else?

Should this cover every agent (triage, prioritize, review, retro, scribe, code, fix), even the ones that don't currently have a duplicate-execution problem — i.e. you want the pattern standardized even where nothing's broken today, not just the two flows Remove redundant pre-code.sh / pre-fix.sh calls from reusable workflows #4718 called out?

Two things revolving this. I would like every agent calling their pre script to gate expensive setups, just for consistency. And then I would like to introduce the env var for all agents as well, so if there is some expensive operator on their pre-script, that can be skipped when running within fullsend run.

@waynesun09

Copy link
Copy Markdown
Member Author

Closing per rh-hemartin's request — harness configs, pre/post scripts, and agent definitions have moved to fullsend-ai/agents, so the harness/scripts-level changes here (internal/scaffold/fullsend-repo/harness/code.yaml, scripts/pre-code.sh, scripts/pre-fix.sh) no longer affect runtime behavior.

Splitting the fix across the correct repos instead:

  • fullsend-ai/agents: the actual harness/script changes (CODE_SKIP_EXISTING_PR_CHECK, FIX_SKIP_TOOL_INSTALL, plus tests) — PR to follow
  • fullsend-ai/fullsend: a new, smaller PR carrying only what genuinely belongs here — the GH_TOKEN fix and the re-added Validate inputs step in reusable-fix.yml

Keeping #4718 open and will link both PRs there. Per rh-hemartin's broader ask (gating expensive setup consistently across all agents, not just code/fix) — noting that as documented follow-up scope on the issue, not blocking this narrower fix.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

component/ci CI pipelines and checks component/harness Agent harness, config, and skills loading requires-manual-review Review requires human judgment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Remove redundant pre-code.sh / pre-fix.sh calls from reusable workflows

2 participants