OSAC-3322: initialize fullsend per-repo installation

[eranco74]

This PR adds the fullsend scaffold files for per-repo installation.

Merge this PR to activate fullsend workflows.

Summary by CodeRabbit

• New Features

  • Added automated handling for supported issue, comment, pull request, and review events.
  • Added a /fs-fix-stop command to stop automated fixes for a pull request.
  • Authorized users can apply a stop label and notify participants; unauthorized requests are ignored.

• Chores

  • Added repository-specific installation settings for event processing and permissions.

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: eranco74

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [eranco74]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[coderabbitai]

Walkthrough

The PR adds Fullsend repository configuration and a GitHub Actions workflow. The workflow dispatches supported events to a reusable workflow and handles authorized /fs-fix-stop comments by applying a label and posting a confirmation.

Changes

Fullsend integration

Layer / File(s)	Summary
Fullsend configuration and event dispatch .fullsend/config.yaml, .github/workflows/fullsend.yaml	Defines installation metadata, the review role, permitted resources, issue targets, event filters, workflow inputs, permissions, and secret forwarding.
Fix-stop authorization and notification .github/workflows/fullsend.yaml	Checks PR authorship or repository permissions for /fs-fix-stop comments. Authorized requests apply the fullsend-no-fix label and post a confirmation.

Estimated code review effort: 3 (Moderate) | ~25 minutes

Sequence Diagram(s)

sequenceDiagram
  participant GitHub
  participant FullsendWorkflow
  participant ReusableDispatchWorkflow
  GitHub->>FullsendWorkflow: supported event
  FullsendWorkflow->>FullsendWorkflow: filter unsupported comments
  FullsendWorkflow->>ReusableDispatchWorkflow: forward event, inputs, and secrets

Loading

sequenceDiagram
  participant GitHub
  participant StopFixJob
  participant RepositoryPermissions
  participant PullRequest
  GitHub->>StopFixJob: `/fs-fix-stop` comment
  StopFixJob->>RepositoryPermissions: check repository permission
  StopFixJob->>PullRequest: verify author or apply label
  StopFixJob->>GitHub: post confirmation comment

Loading

---

Caution

Pre-merge checks failed

Please resolve all errors before merging. Addressing warnings is optional.

• Ignore

❌ Failed checks (1 error)

Check name	Status	Explanation	Resolution
No-Sensitive-Data-In-Logs	❌ Error	The workflow logs COMMENT_USER_LOGIN and the unfiltered gh api error; these values can expose user-identifying data and request/response details in action logs.	Do not log the login or raw API error. Use a generic warning, or redact and mask identifiers before logging.

✅ Passed checks (10 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
No-Hardcoded-Secrets	✅ Passed	The 12 added paths contain no hardcoded credentials, private-key material, embedded URL credentials, or literal secret assignments; workflow values use GitHub secret references.
No-Weak-Crypto	✅ Passed	The PR adds no MD5, SHA-1, DES, RC4, Blowfish, ECB, or custom crypto code; its equality checks compare event metadata and usernames, not secrets or tokens.
No-Injection-Vectors	✅ Passed	The added files contain only static YAML and a quoted shell block; no SQL concatenation, eval/exec, pickle.loads, unsafe yaml.load, os.system, or user data in an unquoted command.
Container-Privileges	✅ Passed	The PR adds only Fullsend config and a GitHub workflow; the delta contains no privileged, hostPID, hostNetwork, hostIPC, SYS_ADMIN, allowPrivilegeEscalation, or container security settings.
Ai-Attribution	✅ Passed	The PR description and sole commit contain no explicit AI-tool-use mention, and the commit has no attribution or Co-Authored-By trailer.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly identifies the initialization of the Fullsend per-repository installation, which matches the pull request objective.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fullsend/scaffold-install

---

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/fullsend.yaml:
- Line 47: Pin the privileged Fullsend reusable workflow in
.github/workflows/fullsend.yaml at the workflow reference on line 47 to the
approved 40-character commit SHA instead of `@v0`. In .fullsend/config.yaml lines
9-11, update every fetched resource URL to use a commit-SHA reference with a
`#sha256`=... integrity fragment; keep allowed_remote_resources as allowlist
prefixes rather than treating them as pins.

🪄 Autofix

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Repository: osac-project/coderabbit/.coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 7f5e54ff-139e-42c9-971e-81a8bf62f397

📥 Commits

Reviewing files that changed from the base of the PR and between 1b8bcee and f22a81f.

📒 Files selected for processing (12)

• .fullsend/config.yaml
• .fullsend/customized/agents/.gitkeep
• .fullsend/customized/env/.gitkeep
• .fullsend/customized/harness/.gitkeep
• .fullsend/customized/plugins/.gitkeep
• .fullsend/customized/policies/.gitkeep
• .fullsend/customized/profiles/.gitkeep
• .fullsend/customized/providers/.gitkeep
• .fullsend/customized/schemas/.gitkeep
• .fullsend/customized/scripts/.gitkeep
• .fullsend/customized/skills/.gitkeep
• .github/workflows/fullsend.yaml

[openshift-ci-robot]

@eranco74: This pull request references OSAC-3322 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the task to target the "5.0.0" version, but no target version was set.

Details

In response to this:

This PR adds the fullsend scaffold files for per-repo installation.

Merge this PR to activate fullsend workflows.

Summary by CodeRabbit

• New Features

• Added automated handling for supported issue, comment, pull request, and review events.

• Added a /fs-fix-stop command to stop automated fixes for a pull request.

• Authorized users can apply a stop label and notify participants; unauthorized requests are ignored.

• Chores

• Added repository-specific installation settings for event processing and permissions.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[omer-vishlitzky]

/retest

[github-actions]

Re-triggered failed runs:

• E2E VMaaS Full Install (#31118792905)
• E2E BMaaS Full Install (#31118792999)
• E2E CaaS Full Install (#31118792942)
• pre-commit (#31118792359)
• Unit Tests (#31118792234)
• Integration Tests (#31118792429)
• Dependency Review (#31118792265)

[omer-vishlitzky]

/lgtm

[omer-vishlitzky]

/lgtm