chore: update fullsend per-repo installation

[ggallen]

The default branch (main) has branch protection rules that prevent direct pushes.

Merge this PR to deliver the scaffold files.

[qodo-code-review]

PR Summary by Qodo

Configure Fullsend per-repository installation

⚙️ Configuration changes ✨ Enhancement 🕐 20-40 Minutes

AI Description

• Adds repository-local Fullsend roles, agents, and resource allowlists.
• Routes repository events through the reusable per-repository dispatcher.
• Supplies required permissions, runtime variables, and cloud credentials.

Diagram

graph TD
  E["GitHub events"] --> S["Repo shim"] --> D["Reusable dispatch"] --> A["Agent jobs"]
  C["Repo config"] --> D
  X["Repo credentials"] --> D

Loading

High-Level Assessment

The following are alternative approaches to this PR:

1. Retain centralized configuration

• ➕ Avoids duplicating configuration across repositories
• ➕ Allows centralized rollout of agent settings
• ➖ Preserves the external configuration-repository dependency
• ➖ Does not execute entirely within the enrolled repository context

2. Vendor dispatch logic locally

• ➕ Eliminates dependence on an external reusable workflow
• ➕ Allows repository-specific workflow customization
• ➖ Duplicates complex routing logic
• ➖ Increases drift and maintenance across enrolled repositories

Recommendation: Use the PR's repository-local configuration with the shared reusable dispatcher. It removes the external configuration-repository dependency while retaining centralized routing logic, avoiding the maintenance burden of vendoring complete workflows into every repository.

Files changed (2) +57 / -27

Other (2) +57 / -27

config.yamlAdd repository-local Fullsend configuration +33/-0

Add repository-local Fullsend configuration

• Defines the Claude runtime, enabled roles, and integrity-pinned agent sources for per-repository installation. Restricts remote resources and issue-creation targets to approved Fullsend repositories.

.fullsend/config.yaml

fullsend.yamlRoute events through per-repository reusable dispatch +24/-27

Route events through per-repository reusable dispatch

• Switches the shim from the centralized configuration repository to Fullsend's reusable dispatcher in per-repository mode. Expands job permissions and passes token-minting, GCP, runner, and telemetry settings while delegating role concurrency to the reusable workflow.

.github/workflows/fullsend.yaml

[qodo-code-review]

Code Review by Qodo

🐞 Bugs (1) 📘 Rule violations (0) 📜 Skill insights (0)

1. Unrelated labels launch dispatch 🐞 Bug ➹ Performance

Description

Removing the ready- label guard makes every issues or pull_request_target labeled event
start the reusable dispatch workflow. Unrecognized labels cannot select a stage, so these runs
consume Actions capacity only to terminate without useful work.

Code

.github/workflows/fullsend.yaml[L51-54]

-      && (
-        github.event.action != 'labeled'
-        || startsWith(github.event.label.name, 'ready-')
-      )

Relevance

●●● Strong

Recent workflow precedents accept filtering labeled events and reducing unnecessary Actions runs;
this directly matches dispatch-cost concerns.

PR-#5457
PR-#1215
PR-#2781

ⓘ Recommendations generated based on similar findings in past PRs

Evidence

The shim subscribes to labeled issue and PR events and its dispatch condition no longer filters by
label. The called router only maps ready-for-triage, ready-to-code, and ready-for-review,
leaving all other label-triggered runs without a stage.

.github/workflows/fullsend.yaml[22-40]
.github/workflows/reusable-dispatch.yml[247-289]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
Every labeled event now invokes the reusable dispatch workflow, including labels unrelated to Fullsend. Restore a caller-side condition that only forwards supported routing labels.

## Issue Context
The reusable router recognizes only specific `ready-*` labels, so unrelated label events start a runner but cannot produce an agent stage.

## Fix Focus Areas
- .github/workflows/fullsend.yaml[36-40]

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

---

Context sources

✅ Compliance rules (platform): 57 rules

✅ Skills: writing-user-docs, writing-adrs

Review mode: ⚖️ Balanced: This changes a GitHub Actions dispatch path, permissions, secrets, and remote workflow/config integration; the behavioral and security-sensitive blast radius warrants a complete single-pass review.

Tip of the day

💡 Did you know, you can copy the agent prompt from any finding and feed it to your IDE agent

More tips ↗ | Customize Qodo ↗ | Qodo docs ↗

[fullsend-ai-sync]

LGTM — per-repo scaffold install

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!