feat(#5271): include private repos in repos.yaml glob expansion

[fullsend-ai-coder]

Summary

• Add includePrivate parameter to forge.Client.ListOrgRepos so callers can opt into listing private repos
• Manifest.ExpandGlobs() now passes includePrivate=true because repos.yaml manifests operate in per-repo mode where agents run on the target repo itself — the per-org rationale for excluding private repos (public config repo, public workflow logs) does not apply
• All existing per-org callers pass false to preserve the original exclusion behavior
• Archived and forked repos remain excluded regardless of the flag

Related Issue

Closes #5271

Changes

Interface & implementations

• internal/forge/forge.go: Extended ListOrgRepos signature with includePrivate bool parameter; updated doc comment
• internal/forge/github/github.go: Split the private-repo filter into a conditional check based on the new parameter
• internal/forge/fake.go: Updated FakeClient.ListOrgRepos to respect the new parameter

Callers

• internal/repos/manifest.go: ExpandGlobs() passes includePrivate=true (repos.yaml = per-repo mode)
• internal/cli/admin.go (7 call sites): pass false (per-org mode)
• internal/cli/github.go: pass false
• internal/layers/dispatch.go: pass false
• internal/repos/init.go: pass false

Tests

• internal/forge/fake_test.go: Added TestFakeClient_ListOrgRepos_IncludePrivate
• internal/forge/github/github_test.go: Added TestListOrgRepos_IncludePrivate
• internal/repos/manifest_test.go: Added TestExpandGlobs_IncludesPrivateRepos; updated existing TestExpandGlobs to verify private repos are now included

Docs

• docs/plans/repos-management.md: Updated limitation note to reflect the implemented design

Testing

• go build ./... compiles cleanly
• go vet ./... passes
• scan-secrets passes on all changed files
• All new and existing tests pass (go test ./internal/forge/... ./internal/repos/...)
• make go-test passes (one pre-existing sandbox network failure in internal/fetch unrelated to this change)

---

Closes #5271

Post-script verification

• Branch is not main/master (agent/5271-glob-include-private)
• Secret scan passed (gitleaks — b84696fd80a59eb24190aad8fdf6d42f6d8f39bc..HEAD)
• PR body secret scan passed (gitleaks — no-git)
• Pre-commit hooks passed (authoritative run on runner)
• Tests ran inside sandbox

[fullsend-ai-review]

🤖 Finished Review · ❌ Failure · Started 10:30 PM UTC · Completed 10:44 PM UTC
Commit: b948836 · View workflow run →

[github-actions]

Site preview

Preview: https://9720b177-site.fullsend-ai.workers.dev

Commit: 2e19492f542f483c9d88b0c71c4ca457e226845b

[fullsend-ai-review]

Looks good to me

Previous run

Review

Findings

Low

• [stale-reference] docs/plans/repos-init.md:148 — The repos-init plan document still references the old 2-argument signature ListOrgRepos(ctx, org). The actual code in internal/repos/init.go is correctly updated to ListOrgRepos(ctx, org, false) in this PR, but the plan document was not updated to match the new 3-argument signature.
  Remediation: Update line 148 to show ListOrgRepos(ctx, org, false) and briefly note the includePrivate parameter.

---

Labels: PR adds includePrivate parameter to forge.Client.ListOrgRepos interface and updates all callers across CLI admin, dispatch, repos, and forge implementations — a feature touching the install/enrollment flow.

Previous run (2)

Review

Findings

Medium

• [stale-doc] docs/plans/repos-management.md:588 — The ExpandGlobs() section at lines 588–596 still describes the old ListOrgRepos(ctx, org) call signature and states "The implementation must extend ListOrgRepos (or add a variant) to include private repos when called from glob expansion." This PR implements that exact change, but this section was not updated and still reads as if the feature is unimplemented. The note block at lines 114–120 was correctly updated.
  Remediation: Update lines 588–596 to reflect the new includePrivate parameter (e.g., ListOrgRepos(ctx, org, true)) and remove the future-tense language.

• [stale-doc] docs/plans/repos-management.md:693 — The PR 3 implementation section at lines 693–699 still describes adding an includePrivate parameter as a future task: "Also add a ListOrgReposIncludePrivate(ctx, org) method (or an includePrivate bool parameter on ListOrgRepos)..." This PR implements exactly this, so the section is now obsolete.
  Remediation: Update lines 693–699 to reflect that the includePrivate bool parameter has been added to ListOrgRepos.

[codecov]

Codecov Report

❌ Patch coverage is 92.00000% with 2 lines in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
internal/cli/admin.go	71.42%	2 Missing ⚠️

📢 Thoughts on this report? Let us know!

[ggallen]

/fs-fix fix the review issues in #5275 (comment).

[fullsend-ai-coder]

🤖 Finished Fix · ✅ Success · Started 10:51 PM UTC · Completed 10:57 PM UTC
Commit: cc7a526 · View workflow run →

[fullsend-ai-coder]

🔧 Fix agent — iteration 1 (human-triggered)

Fixed both stale-doc findings by updating docs/plans/repos-management.md to reflect the implemented includePrivate parameter on ListOrgRepos. Both sections now use present tense and describe the actual implementation, consistent with the note block at lines 114-118 which was already updated by the original PR.

Fixed (2):

1. [stale-doc] ExpandGlobs() section at lines 588-596 still describes old ListOrgRepos(ctx, org) signature (docs/plans/repos-management.md): Updated lines 586-594 to reflect the implemented ListOrgRepos(ctx, org, true) call with includePrivate parameter. Replaced future-tense language ('The implementation must extend...') with present-tense description of the implemented design.
2. [stale-doc] PR 3 implementation section at lines 693-699 still describes includePrivate as future task (docs/plans/repos-management.md): Updated lines 691-697 to state that ListOrgRepos now accepts an includePrivate bool parameter, replacing the future-tense proposal language ('Also add a ListOrgReposIncludePrivate...').

Tests: passed

_{Updated by fullsend fix agent}

[github-actions]

E2E tests did not run

E2E tests run automatically for org/repo members and collaborators on pull requests.

For other contributors, a maintainer must add the ok-to-test label after the latest push.

See E2E testing guide for details.

[github-actions]

E2E tests did not run

E2E tests run automatically for org/repo members and collaborators on pull requests.

For other contributors, a maintainer must add the ok-to-test label after the latest push.

See E2E testing guide for details.

[ggallen]

/fs-fix Rebase and address the review issues, both in-line and on the sticky comment. Don't forget to resolve the issues.

[fullsend-ai-coder]

🤖 Finished Fix · ❌ Failure · Started 12:34 AM UTC · Completed 12:41 AM UTC
Commit: cc7a526 · View workflow run →

[ggallen]

/fs-fix Rebase and address the review issues, both in-line and on the sticky comment. Don't forget to resolve the issues.

[fullsend-ai-coder]

🤖 Finished Fix · ✅ Success · Started 4:22 PM UTC · Completed 4:32 PM UTC
Commit: 7ada4e0 · View workflow run →

[fullsend-ai-coder]

🔧 Fix agent — iteration 2 (human-triggered)

Rebased branch onto origin/main and fixed build breakage caused by the GitLab forge client (added to main after original branch) not implementing the updated ListOrgRepos(ctx, org, includePrivate) interface. Both stale-doc findings from the review bot were already addressed in iteration 1. All tests pass.

Fixed (6):

1. Rebase onto main: Rebased the branch onto origin/main to incorporate commits that landed after the original branch was created. The rebase applied cleanly with no conflicts.
2. GitLab ListOrgRepos interface mismatch after rebase (internal/forge/gitlab/repo.go): The rebase pulled in the GitLab forge client (added to main after the original branch). Its ListOrgRepos method used the old signature without the includePrivate bool parameter. Updated the signature, filtering logic (archived/forked always excluded; private excluded only when includePrivate=false), and the Private field on returned repositories to match the GitHub implementation pattern.
3. GitLab test call sites need updated signature (internal/forge/gitlab/gitlab_test.go): Updated TestListOrgRepos call site to pass includePrivate=false, matching the updated interface.
4. GitLab methods_test call sites need updated signature (internal/forge/gitlab/methods_test.go): Updated TestListOrgRepos_ExcludesInternal and TestListOrgRepos_IncludesSubgroups call sites to pass includePrivate=false.
5. [stale-doc] ExpandGlobs() section still describes old ListOrgRepos signature (docs/plans/repos-management.md): Already fixed in iteration 1 (commit 8cf1c6b). Lines 586-591 now correctly describe the ListOrgRepos(ctx, org, true) call with includePrivate parameter.
6. [stale-doc] PR 3 implementation section describes includePrivate as future task (docs/plans/repos-management.md): Already fixed in iteration 1 (commit 8cf1c6b). Lines 688-691 now state that ListOrgRepos accepts the includePrivate bool parameter.

Tests: passed

Decision points

• GitLab visibility filtering uses p.Visibility != public to determine private status, matching GitLab's three-tier visibility model (public/internal/private). Both internal and private are treated as private=true when includePrivate is false. (alternatives: Separate handling for internal vs private visibility; rationale: Matches the existing behavior where non-public repos were excluded, and aligns with the GitHub client's binary public/private model. Internal GitLab repos have the same security concern as private ones in per-org mode.)

_{Updated by fullsend fix agent}

[ggallen]

/fs-review

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 4:59 PM UTC · Completed 5:14 PM UTC
Commit: 7ada4e0 · View workflow run →

[ggallen]

/fs-fix Rebase and address the review issues, both in-line and on the sticky comment. Don't forget to resolve the issues.

[fullsend-ai-coder]

🤖 Finished Fix · ❌ Failure · Started 5:18 PM UTC · Completed 5:26 PM UTC
Commit: 7ada4e0 · View workflow run →

[fullsend-ai-coder]

⚠️ Post-fix script failed — Signed-off-by rejected (exit code 1)

The fix agent completed, but the post-fix script failed before finishing.

Workflow run: https://github.com/fullsend-ai/.fullsend/actions/runs/29852268133

Details:
Agent commit contains a Signed-off-by trailer. Agents must not use 'git commit -s' or append Signed-off-by trailers.
Please check the workflow logs for full details and retry with /fs-fix if appropriate.

[ggallen]

/fs-fix Rebase and address the review issues, both in-line and on the sticky comment. Don't forget to resolve the issues. CRITICAL: DO NOT TRY TO SIGN THE COMMIT!

[fullsend-ai-coder]

🤖 Finished Fix · ❌ Failure · Started 5:39 PM UTC · Completed 5:46 PM UTC
Commit: 7ada4e0 · View workflow run →

[fullsend-ai-coder]

⚠️ Post-fix script failed — Signed-off-by rejected (exit code 1)

The fix agent completed, but the post-fix script failed before finishing.

Workflow run: https://github.com/fullsend-ai/.fullsend/actions/runs/29853794757

Details:
Agent commit contains a Signed-off-by trailer. Agents must not use 'git commit -s' or append Signed-off-by trailers.
Please check the workflow logs for full details and retry with /fs-fix if appropriate.

[ggallen]

Reviewed the changes. The includePrivate parameter addition to ListOrgRepos is clean:

• Interface extended correctly with all callers updated
• Per-org callers pass false (preserving existing behavior), per-repo glob expansion passes true
• GitLab implementation added after rebase correctly mirrors the GitHub pattern
• Tests cover both include/exclude paths
• Stale doc references fixed
• Coverage threshold met (92% patch)

LGTM.

[ggallen]

/fs-review

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 7:32 PM UTC · Completed 7:47 PM UTC
Commit: 7ada4e0 · View workflow run →

[fullsend-ai-retro]

🤖 Finished Retro · ✅ Success · Started 8:05 PM UTC · Completed 8:32 PM UTC
Commit: 2e19492 · View workflow run →

[fullsend-ai-retro]

Retro: PR #5275 — include private repos in repos.yaml glob expansion

Outcome: Merged after 11 agent runs (1 triage, 1 code, 3 review, 5 fix, 1 retro). The code agent created the PR in 23 minutes from issue creation with a clean 16-file implementation including tests. The primary workflow friction was a post-fix script bug that caused 3 unnecessary fix failures and forced the human to manually squash-merge.

Review quality

Good. The review agent correctly identified stale-doc findings in plan documents. The challenger correctly removed false positives — notably a security finding where the doc comment had actually been updated in the diff, and a duplicate finding from overlapping sub-agents. The final review approved with zero findings, aligning with the human reviewer's independent assessment. No human-review findings were missed by the agent.

Rework analysis

5 fix runs total (2 succeeded, 3 failed). All 3 failures shared the same root cause: the post-fix.sh Signed-off-by trailer check uses PRE_AGENT_HEAD..HEAD as the scan range. After a rebase, PRE_AGENT_HEAD is no longer an ancestor of HEAD, so the range captures main-branch commits with legitimate DCO trailers. The error message ("agent commit contains a Signed-off-by trailer") was misleading — the trailers were on human commits from main, not agent commits — leading the human to instruct "CRITICAL: DO NOT TRY TO SIGN THE COMMIT!" which could not resolve the issue.

This same bug was independently discovered by a retro on PR #5273 on the same day, confirming it is a systemic issue affecting any fix run that includes a rebase.

Existing issues with new evidence

• Post-script commit-range checks should be audited for rebase safety #5419 (Post-script commit-range checks should be audited for rebase safety): PR feat(#5271): include private repos in repos.yaml glob expansion #5275 provides additional corroborating evidence. Fix runs 29852268133 and 29853794757 both failed with false-positive Signed-off-by detection after rebase. The earlier Jul 18 failure (29623339027) was the same root cause. Total: 3 wasted fix runs, ~25 minutes of compute, and forced manual squash-merge intervention.

• Review workflow shows Failure status despite agent producing valid approve output and posting review content #3548 (Review workflow shows Failure despite valid output): The initial review run (29618047159) produced valid stale-doc findings and posted them to the sticky comment, but the workflow concluded as "failure" due to a post-review script issue.

• Enable post-script-only retry when agent succeeds but post-script fails #2138 (Enable post-script-only retry when agent succeeds but post-script fails): All 3 failed fix runs completed agent work successfully before the post-script rejected them. Post-script-only retry would have avoided 3 full agent re-runs.

No new proposals

All identified improvement opportunities are covered by existing open issues. The workflow otherwise performed well — fast code generation, accurate review findings, effective challenger adjudication, and good alignment between agent and human review.