Repository navigation
Conversation
The floating reusable-dispatch.yml@v0 tag advanced to c68903c0, which moved GCP setup into ./.defaults and no longer exports GOOGLE_APPLICATION_CREDENTIALS before fullsend run, so every verify-pr dispatch failed harness host_files validation. Pin to d5f36921 (v0 as of the last green run, 2026-09-30). Remove the vendor shim .github/workflows/fullsend.yaml: it went live on main after the verify-pr-fullsend graduation and fires the vendor Review agent on every PR, but this deployment is verify-pr-only and dispatches verify-pr directly. Update header comments and fullsend.md accordingly. Implements TC-6909 Assisted-by: Claude Code Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Contributor
Reviewer's GuideThe PR stabilizes verify-pr dispatch by pinning reusable-dispatch to the last known-good vendor commit, removes the now-unwanted vendor pull_request_target shim, and updates configuration/documentation to explain the direct workflow and safe pin-advance process. Existing triggers, gating, permissions, concurrency, secrets, and harness configuration remain unchanged. File-Level Changes
Tips and commandsInteracting with Sourcery
Customizing Your ExperienceAccess your dashboard to:
Getting Help
|
|
🤖 Finished Review · ✅ Success · Started 4:42 PM UTC · Completed 4:52 PM UTC Commit: Runtime: claude · Model: opus → claude-opus-4-8 · Effort: high · Cost: $5.61 |
![sourcery-ai[bot]](https://avatars.githubusercontent.com/in/48477?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Hey - I've found 1 issue
Prompt for AI Agents
Please address the comments from this code review:
## Individual Comments
### Comment 1
<location path="fullsend.md" line_range="156-157" />
<code_context>
- dispatches verify-pr, while `fullsend dispatch` / `fullsend run` still resolve
- it because `LoadConfig` merges `config.yaml` over `config.base.yaml` (ADR 0069).
+ layer, and `.fullsend/config.yaml`, the repo overlay). `install_mode: per-repo`
+ throughout. **verify-pr is registered only in `config.base.yaml`**;
+ `fullsend dispatch` / `fullsend run` resolve it because `LoadConfig` merges
+ `config.yaml` over `config.base.yaml` (ADR 0069). Setup also scaffolds the
+ vendor shim workflow `.github/workflows/fullsend.yaml` — a
</code_context>
<issue_to_address>
**Agent registration guidance conflicts**
When a maintainer consults the guide to change the agent registration, the new installation section says `verify-pr` is registered only in `config.base.yaml`, while the guide’s “How it works” section and file inventory still say `.fullsend/config.yaml` registers it. Maintainers consulting the guide get conflicting directions about where to change the registration.
Update the remaining guide descriptions to say the registration is in `.fullsend/config.base.yaml`.
</issue_to_address>Sourcery assessment
Needs a human reviewer. The pinned reusable workflow runs with OIDC-backed credentials and pull-request write permissions; if this revision mishandles them, credentials or PR actions could be exposed or misused. Reverting restores the prior workflow but cannot undo any exposure or PR actions that already occurred.
|
Risk Assessment: moderate (2/5) DetailsCI-workflow and protected-path changes raise metadata risk, but the config/CI/docs-only diff with no security or dependency files, an experienced author, and a very recent low-churn feature area keep the composite at moderate. Previous runRisk Assessment: moderate (2/5) DetailsTier 1 metadata signals (file-count range, 2 protected-path changes, no dependency changes, human author) are unchanged from the prior assessment, and stable single-author git history with no reverts or regression fixes provides no reason to differ, so the moderate score is preserved. Previous run (2)Risk Assessment: moderate (2/5) DetailsCI/workflow edits and two protected-path (.github/workflows) changes raise Tier 1 above a routine baseline, but low churn, a single author, and very recent/stable git history with no source, test, or dependency changes keep overall risk moderate. |
ReviewFindingsMedium
Low
Next steps:
Previous runReviewFindingsMedium
Low
Next steps:
Previous run (2)ReviewFindingsMedium
|
fullsend-ai-review
Bot
added
the
requires-manual-review
Collaborator
Author
|
[sdlc-workflow/verify-pr] Re: @sourcery-ai[bot] review —
|
Collaborator
Author
Verification Report for TC-6909 (commit e49babf)
Overall: WARN
This comment was AI-generated by sdlc-workflow/verify-pr v0.13.10. |
The "How it works" bullet and file-inventory row still said .fullsend/config.yaml registers verify-pr, contradicting the install section. Registration (and the allowed remote-resource prefix) live in config.base.yaml; config.yaml is the inference-only repo overlay. Implements TC-6911 Assisted-by: Claude Code Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
|
🤖 Finished Review · ✅ Success · Started 5:06 PM UTC · Completed 5:24 PM UTC Commit: Runtime: claude · Model: opus → claude-opus-4-8 · Effort: high · Cost: $9.60 |
![fullsend-ai-review[bot]](https://avatars.githubusercontent.com/in/3478501?s=60&v=4){kind=small}
This comment was marked as outdated.
This comment was marked as outdated.
Sorry, something went wrong.
This comment was marked as outdated.
This comment was marked as outdated.
Sorry, something went wrong.
fullsend-ai-review
Bot
removed
the
requires-manual-review
Collaborator
Author
|
[sdlc-workflow/verify-pr] Re: @fullsend-ai-review[bot] review — Classified as suggestion (pin |
Collaborator
Author
Verification Report for TC-6909 (commit f9d2dc1)
Overall: WARN
This comment was AI-generated by sdlc-workflow/verify-pr v0.13.10. |
config.base.yaml registers both verify-pr and triage-security; the setup bullet and file-inventory row only named verify-pr. Implements TC-6913 Assisted-by: Claude Code Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
|
🤖 Finished Review · ✅ Success · Started 9:37 PM UTC · Completed 9:55 PM UTC Commit: Runtime: claude · Model: opus → claude-opus-4-8 · Effort: high · Cost: $7.55 |
There was a problem hiding this comment.
Note: The following review comments could not be posted on the diff (GitHub returned 422) and are included here instead:
fullsend.md(file-level): Line 11 ·
[low] correctness
The intro (lines 9-14, not changed by this PR) still states 'a single pinned-URL registration' and 'the only skill wired up today is verify-pr', while this PR's body edits now document two registered agents (verify-pr and triage-security) in .fullsend/config.base.yaml. The tension is largely pre-existing and partly reconcilable ('wired up ... via a CI-gated dispatch' can be read as verify-pr being the only CI-dispatched skill), so no change is strictly required here; reconciling the intro with the expanded body would improve coherence.
.github/workflows/fullsend-verify-pr.yml(file-level): Line 226 ·
[low] supply-chain
Pre-existing (not introduced by this diff): the remove-ok-to-test job uses actions/github-script@v9, a floating major-version tag, within a pull_request_target workflow. Risk is limited — a first-party action with narrow permissions (pull-requests: write), and @v9 is a repo-wide convention (10+ uses elsewhere), so pinning only this occurrence would be inconsistent and out of scope for this PR. Noted for awareness; the SHA pin this PR adds to reusable-dispatch is the correct, in-scope strengthening.
| the `verify-pr` and `triage-security` agents (`source: harness/verify-pr.yaml` | ||
| / `harness/triage-security.yaml`, i.e. the **local composing children** | ||
| `.fullsend/harness/verify-pr.yaml` and `.fullsend/harness/triage-security.yaml`) | ||
| and the single allowed remote-resource prefix. `.fullsend/config.yaml` is the repo overlay (inference |
There was a problem hiding this comment.
[low] documentation-comment-format
The line added by this PR runs to ~100 columns, breaking the ~80-column prose wrap used throughout fullsend.md. There is a natural break after 'prefix.'.
Suggested fix: Re-wrap the line so the sentence about the overlay ('.fullsend/config.yaml is the repo overlay ...') starts on a new ~80-column line, matching the surrounding paragraph.
Collaborator
Author
There was a problem hiding this comment.
[sdlc-workflow/verify-pr] Classified as nit: a cosmetic line-wrap issue that does not affect correctness. CONVENTIONS.md (Code Style) sets "No strict limit" on line length, and fullsend.md has no consistent 80-column wrap (150 of 691 lines are longer than 80 columns). No sub-task created.
Collaborator
Author
|
[sdlc-workflow/verify-pr] Re: @fullsend-ai-review[bot] review (8dae549) —
|
Collaborator
Author
Verification Report for TC-6909 (commit 8dae549)
Overall: WARN
This comment was AI-generated by sdlc-workflow/verify-pr v0.13.10. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
.github/workflows/fullsend-verify-pr.ymltod5f36921ac754705619f38c637ef692873809fbc # v0 as of 2026-09-30. The floating@v0tag advanced toc68903c0, which moved GCP setup into./.defaultsand no longer exportsGOOGLE_APPLICATION_CREDENTIALSbeforefullsend run→ every verify-pr dispatch failed withhost_files[1].src: host variable GOOGLE_APPLICATION_CREDENTIALS is not set(e.g. PR ci: remove retired verify-pr-fullsend branch filters #337, run 38410084785)..github/workflows/fullsend.yaml. As apull_request_targetworkflow it only became active once it reachedmain(PR feat(fullsend): integrate verify-pr and triage-security (TC-6201) #299), and it now posts the vendor Review agent on every PR. This deployment only runs verify-pr, whichfullsend-verify-pr.ymldispatches directly.fullsend-verify-pr.yml,.fullsend/config.yaml) andfullsend.md: removed the shim/config-grep rationale and added a Pinning reusable-dispatch section explaining when and how to advance the pin.fullsend.md"How it works" bullet and file-inventory table now say verify-pr is registered in.fullsend/config.base.yaml(where the allowed remote-resource prefix also lives);.fullsend/config.yamlis described as the inference-only repo overlay.fullsend.mdsetup bullet and file-inventory row for.fullsend/config.base.yamlnow name both registered agents,verify-prandtriage-security.fullsend_version, the trigger, theok-to-testgate, concurrency, permissions and the secrets mapping are unchanged. The harness, lock and base config are untouched. Adaptinghost_filesto the new vendor credential model is a separate follow-up.Verification
git diff --checkclean;git grep 'reusable-dispatch.yml@v0' -- .github→ no matches; shim deleteduvx skillsaw(0 errors),claude plugin validate plugins/sdlc-workflowpassedfullsend-ai/fullsendwithreusable-dispatch.ymlpresentExpected: this PR's own verify-pr run will still fail.
pull_request_targetrunsmain's copy of the workflow, not this branch's. The end-to-end proof is re-triggering verify-pr on PR #337 after this merges.Implements TC-6909
🤖 Generated with Claude Code
Summary by Sourcery
Stabilize Fullsend verify-pr dispatches by pinning the reusable workflow and removing the obsolete vendor shim.
Bug Fixes:
Enhancements:
CI:
Documentation:
Chores: