fix(dispatch): pass pr-head-sha to action.yml in harness-run job

[waynesun09]

Summary

• Thread pr-head-sha from matrix.event_payload through to action.yml in the harness-run job, mirroring the fix fix(dispatch): resolve PR head SHA for issue_comment events #5274 applied to the five stage jobs (triage, code, review, fix, retro)
• Without this, comment-triggered custom harness agents fall through to GITHUB_SHA and operate on the wrong commit
• Extend TestReusableDispatchPRHeadSHAPassthrough to cover harness-run alongside the five stage jobs

Root cause

harness-run's "Run harness agent" step was omitted from #5274. It passes neither the explicit pr-head-sha input nor a wrapped event_payload to action.yml, so the SHA resolution falls through to tier 3 (GITHUB_SHA) — the config-repo checkout SHA instead of the PR's actual head.

The fix

The Go harnessdispatch package already populates matrix.event_payload with the correct SHA via a real API lookup (opts.Forge.GetPullRequestInfo). This PR simply extracts it and passes it through:

pr-head-sha: ${{ fromJSON(matrix.event_payload).pull_request.head.sha || '' }}

Test plan

• TestReusableDispatchPRHeadSHAPassthrough now includes harness-run subtest — passes
• Full internal/scaffold test suite passes
• make lint clean
• Verify in a live comment-triggered harness-run that the agent sees the correct PR head SHA

Closes #5329

[qodo-code-review]

PR Summary by Qodo

Fix harness-run dispatch to pass PR head SHA into composite action

🐞 Bug fix 🧪 Tests 🕐 20-40 Minutes

AI Description

• Pass pr-head-sha from matrix.event_payload into the harness-run composite action inputs.
• Prevent comment-triggered custom harness agents from running against the config repo GITHUB_SHA.
• Extend scaffold alignment tests to assert harness-run also threads PR head SHA correctly.

Diagram

graph TD
  A{{"GitHub PR event"}} --> B["reusable-dispatch.yml"] --> C["harness-run job"] --> D["action.yml"] --> E{{"Custom harness agent"}}
  B --> F["stage jobs"] --> D

Loading

High-Level Assessment

The following are alternative approaches to this PR:

1. Compute and expose `pr_head_sha` as a first-class matrix field

• ➕ Avoids repeated fromJSON(...) expressions in workflow steps
• ➕ Makes the required input more discoverable and harder to omit in future jobs
• ➖ Requires changing the matrix schema and any downstream consumers
• ➖ Slightly larger change surface than the current one-line fix

2. Resolve PR head SHA inside the composite action via GitHub API

• ➕ Eliminates dependence on upstream workflow wiring for correctness
• ➕ Keeps workflow YAML simpler
• ➖ Requires GitHub API permissions/token handling inside the action
• ➖ Adds network calls and failure modes to every action run
• ➖ Harder to test deterministically compared to passing a value in

Recommendation: Keep the PR’s current approach: pass pr-head-sha from matrix.event_payload in the workflow. It’s the smallest change, aligns harness-run with the already-correct stage jobs, and preserves the existing design where the dispatch layer performs the authoritative PR lookup and supplies the resolved SHA to the action.

Files changed (2) +17 / -0

Bug fix (1) +1 / -0

reusable-dispatch.ymlThread PR head SHA into harness-run composite action inputs +1/-0

Thread PR head SHA into harness-run composite action inputs

• Adds a 'pr-head-sha' input to the harness-run invocation, sourced from 'fromJSON(matrix.event_payload).pull_request.head.sha'. This prevents fallback to 'GITHUB_SHA' when running comment-triggered custom harness agents.

.github/workflows/reusable-dispatch.yml

Tests (1) +16 / -0

workflow_call_alignment_test.goAdd harness-run coverage to PR head SHA passthrough test +16/-0

Add harness-run coverage to PR head SHA passthrough test

• Extends 'TestReusableDispatchPRHeadSHAPassthrough' with a 'harness-run' subtest that locates the "Run harness agent" step and asserts 'pr-head-sha' is present and populated from '.pull_request.head.sha' in 'event_payload'. This guards against regressions where harness-run diverges from the stage jobs.

internal/scaffold/workflow_call_alignment_test.go

[fullsend-ai-review]

🤖 Review · ⚠️ Cancelled · Started 3:06 PM UTC · Ended 3:11 PM UTC
Commit: 9220b47 · View workflow run →

[github-actions]

Site preview

Preview: https://7ae32f89-site.fullsend-ai.workers.dev

Commit: 49cb559fdc1c04e9eb7aaa73de4efa5dea8de9cd

[qodo-code-review]

Code Review by Qodo

🐞 Bugs (0) 📘 Rule violations (0) 📎 Requirement gaps (0)

Great, no issues found!

Qodo reviewed your code and found no material issues that require review

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 3:13 PM UTC · Completed 3:24 PM UTC
Commit: 49cb559 · View workflow run →

[fullsend-ai-review]

Review

Findings

Medium

• [protected-path] .github/workflows/reusable-dispatch.yml — This PR modifies a file under .github/, a protected path that requires human approval. The change is authorized by issue harness-run job doesn't pass pr-head-sha to action.yml, so custom harness agents keep the wrong-SHA bug from #5271/#5274 #5329 to fix the wrong-SHA bug for comment-triggered custom harness agents, and the implementation correctly mirrors the existing stage-job pattern from PR fix(dispatch): resolve PR head SHA for issue_comment events #5274. Human approval is always required for governance and infrastructure file changes, regardless of context.

---

Labels: PR fixes a dispatch bug in the harness-run job's SHA passthrough

[fullsend-ai-retro]

🤖 Finished Retro · ✅ Success · Started 12:51 PM UTC · Completed 1:04 PM UTC

Commit: 49cb559 · View workflow run →

[fullsend-ai-retro]

Retro: PR #5573 — fix(dispatch): pass pr-head-sha to action.yml in harness-run job

This was a clean, well-executed workflow for a small, surgical bug fix (1 production YAML line + 18 test lines). The PR fixed an omission from PR #5274 where the harness-run job was not passing pr-head-sha to action.yml, causing custom harness agents to operate on the wrong commit SHA.

Timeline

1. Jul 19 — Issue #5329 filed by waynesun09. Triage agent confirmed the bug and labeled it blocked (waiting for PR fix(dispatch): resolve PR head SHA for issue_comment events #5274 to merge).
2. Jul 21 — Code agent attempted /fs-code and generated the correct fix, but the push was rejected because the GitHub App lacks workflows write permission for .github/workflows/ files.
3. Jul 24 — Wayne manually created PR fix(dispatch): pass pr-head-sha to action.yml in harness-run job #5573. First review run dispatched on PR open, then cancelled ~5 min later when a force push triggered a second run.
4. Jul 24 15:11–15:24 — Second review run completed successfully ($3.00, 13 min, 4 sub-agents + challenger). Posted one medium finding: protected-path governance requiring human approval. Applied labels: requires-manual-review, component/dispatch, bug.
5. Aug 3 — rh-hemartin approved (silent approval).
6. Aug 7 — Merged via merge queue.

Workflow quality assessment

• Review quality: Good. The review agent correctly identified the protected-path governance requirement and applied appropriate labels. No false positives, no missed issues. Sub-agents (correctness, security, intent-coherence, style) all returned clean results, consistent with the straightforward nature of the change.
• Rework rate: Zero. The PR was correct on first submission with no review-requested changes.
• Token cost: Acceptable but heavy for the PR size. $3.00 and 13 minutes for a 19-line pattern-following fix is on the high side. The challenger sub-agent found nothing to remove (no significant findings to challenge).
• Time to resolution: 14 days. Most delay was human-side: 10 days waiting for human review (Jul 24 → Aug 3), then 4 days from approval to merge.
• Autonomy readiness: The protected-path governance policy (requiring human approval for .github/workflows/ changes) is working as intended. The review agent correctly flagged it, and the human reviewer confirmed correctness.

Existing issues with new supporting evidence

All candidate improvement areas from this retro are already well-tracked. This PR provides additional supporting evidence for:

• #5777 (review model routing by diff complexity): This 1-line YAML change + 18-line test following an established pattern received 4 sub-agents + challenger — evidence that complexity-based routing would save cost here.
• #2981 (skip challenger when findings are below threshold): All sub-agent findings were info-level or lower; the challenger pass was a no-op.
• #3627 (code agent should treat .github/workflows/ as unpushable): The code agent generated the correct fix on Jul 21 but couldn't push, forcing manual PR creation.
• #4960 (debounce review on rapid force-pushes): The first review run burned ~5 min of compute before being cancelled by a force push.

No new proposals. The workflow executed cleanly and all identified improvement opportunities are already tracked by existing open issues.