reusable-dispatch.yml

# Reusable dispatch workflow for per-repo installation mode.
# Routes events to the appropriate stage reusable workflow via conditional
# workflow_call jobs. This is the per-repo equivalent of the per-org
# dispatch.yml + thin caller pair.
#
# Concurrency: each stage job declares a per-role cancel-in-progress dispatch group.
# Reusable stage workflows use distinct agent-scoped groups (fullsend-{stage}-agent-…)
# so workflow_call parents are not cancelled. Roles operate independently — review
# dispatches do not cancel triage, code, fix, etc.
#
# Flow: shim (per-repo) → reusable-dispatch.yml → reusable-{stage}.yml
# Nesting: 3 levels of workflow_call (within GitHub's 4-level limit)
#
# Stage workflows are referenced with fully-qualified paths
# (fullsend-ai/fullsend/.github/workflows/reusable-{stage}.yml@v0) because
# relative (./) paths resolve against the *caller's* repo, which breaks
# per-repo mode where the caller is an external repo.
#
# Security: all user-controlled inputs (comment body, labels, usernames)
# are passed via env: variables, not interpolated in run: blocks.
name: Dispatch

on:
  workflow_call:
    inputs:
      event_action:
        description: "The event action (github.event.action) forwarded by the shim"
        required: true
        type: string
      install_mode:
        description: "Installation mode: per-repo (default) or per-org"
        required: false
        type: string
        default: "per-repo"
      mint_url:
        description: "Token mint URL for OIDC token exchange"
        required: true
        type: string
      gcp_region:
        description: "GCP region for Vertex AI"
        required: true
        type: string
      fullsend_version:
        description: "Fullsend CLI version to use"
        required: false
        type: string
        default: "latest"
      fullsend_ai_ref:
        description: "Deprecated: stage workflows now use job.workflow_sha. Kept so existing shims that pass this input do not break."
        type: string
        required: false
        default: v0
      project_number:
        description: "GitHub Projects V2 project number for RICE scoring (prioritize agent)"
        required: false
        type: string
        default: ""
      runner_image:
        description: GitHub Actions runner image for agent jobs.
        type: string
        required: false
        default: "ubuntu-24.04"
    secrets:
      FULLSEND_GCP_WIF_PROVIDER:
        required: false
      FULLSEND_GCP_PROJECT_ID:
        required: true

jobs:
  route:
    name: Route
    runs-on: ${{ inputs.runner_image }}
    permissions:
      contents: read
      pull-requests: read
    outputs:
      stage: ${{ steps.role-check.outputs.skipped != 'true' && steps.pr-check.outputs.skipped != 'true' && steps.route.outputs.stage || '' }}
      trigger_source: ${{ steps.route.outputs.trigger_source }}
      event_payload: ${{ steps.payload.outputs.event_payload }}
    steps:
      - name: Checkout caller repository
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          persist-credentials: false
          sparse-checkout: .fullsend/config.yaml
          sparse-checkout-cone-mode: false

      - name: Determine stage
        id: route
        env:
          EVENT_NAME: ${{ github.event_name }}
          EVENT_ACTION: ${{ inputs.event_action }}
          COMMENT_BODY: ${{ github.event.comment.body }}
          COMMENT_USER_TYPE: ${{ github.event.comment.user.type }}
          COMMENT_USER_LOGIN: ${{ github.event.comment.user.login }}
          COMMENT_AUTHOR_ASSOC: ${{ github.event.comment.author_association }}
          ISSUE_LABELS: ${{ join(github.event.issue.labels.*.name, ',') }}
          PR_LABELS: ${{ join(github.event.pull_request.labels.*.name, ',') }}
          ISSUE_IS_PR: ${{ github.event.issue.pull_request && 'true' || 'false' }}
          ISSUE_USER_LOGIN: ${{ github.event.issue.user.login }}
          EVENT_SENDER_LOGIN: ${{ github.event.sender.login }}
          REVIEW_STATE: ${{ github.event.review.state }}
          REVIEW_USER_LOGIN: ${{ github.event.review.user.login }}
          TRIGGERING_LABEL: ${{ github.event.label.name }}
          PR_HEAD_REPO: ${{ github.event.pull_request.head.repo.full_name }}
          PR_BASE_REPO: ${{ github.event.pull_request.base.repo.full_name }}
          PR_USER_LOGIN: ${{ github.event.pull_request.user.login }}
          ORG_NAME: ${{ github.repository_owner }}
          GH_TOKEN: ${{ github.token }}
        run: |
          set -euo pipefail

          STAGE=""
          TRIGGER_SOURCE=""

          # Helper: check actor has write+ permission on the repo.
          # Uses the collaborator permission API which correctly resolves org
          # membership regardless of visibility (private vs public).
          # See: github/gh-aw-mcpg#2862
          has_write_permission() {
            local username="${1:-}"
            if [[ -z "${username}" ]]; then
              return 1
            fi
            local role api_err
            api_err=$(mktemp) || {
              echo "::warning::Failed to create temp file for permission check of ${username}" >&2
              return 1
            }
            role=$(gh api "repos/${GITHUB_REPOSITORY}/collaborators/${username}/permission" \
              --jq '.role_name' 2>"${api_err}") || {
              echo "::warning::Permission API call failed for ${username}: $(cat "${api_err}")" >&2
              rm -f "${api_err}"
              return 1
            }
            rm -f "${api_err}"
            case "${role}" in
              admin|maintain|write) return 0 ;;
              *) return 1 ;;
            esac
          }

          # Slash command authorization (comment-triggered paths)
          is_authorized() {
            has_write_permission "${COMMENT_USER_LOGIN}"
          }

          # Event-level authorization (non-comment triggers)
          is_event_actor_authorized() {
            has_write_permission "${1:-}"
          }

          is_issue_author() {
            [[ "${COMMENT_USER_LOGIN}" == "${ISSUE_USER_LOGIN}" ]]
          }

          has_label() {
            local needle="$1"
            local csv="${2:-${ISSUE_LABELS}}"
            IFS=',' read -ra labels <<< "${csv}"
            for l in "${labels[@]}"; do
              [[ "$l" == "$needle" ]] && return 0
            done
            return 1
          }

          COMMAND=""
          if [[ -n "${COMMENT_BODY:-}" ]]; then
            COMMAND="$(printf '%s\n' "${COMMENT_BODY}" | head -1 | tr -d '\r' | awk '{print $1}')"
          fi

          case "${EVENT_NAME}" in
            issue_comment)
              case "${COMMAND}" in
                /fs-triage)
                  if [[ "${COMMENT_USER_TYPE}" != "Bot" ]] && is_authorized; then
                    STAGE="triage"
                  fi
                  ;;
                /fs-code)
                  if [[ "${ISSUE_IS_PR}" == "false" ]]; then
                    if [[ "${COMMENT_USER_TYPE}" != "Bot" ]] && is_authorized; then
                      STAGE="code"
                    fi
                  fi
                  ;;
                /fs-review)
                  if [[ "${ISSUE_IS_PR}" == "true" ]]; then
                    if [[ "${COMMENT_USER_TYPE}" != "Bot" ]] && is_authorized; then
                      STAGE="review"
                    fi
                  fi
                  ;;
                /fs-fix)
                  if [[ "${ISSUE_IS_PR}" == "true" ]]; then
                    if [[ "${COMMENT_USER_TYPE}" != "Bot" ]] && is_authorized; then
                      STAGE="fix"
                      TRIGGER_SOURCE="${COMMENT_USER_LOGIN}"
                    fi
                  fi
                  ;;
                /fs-retro|/fullsend)
                  if [[ "${COMMENT_USER_TYPE}" != "Bot" ]] && is_authorized; then
                    if [[ "${COMMAND}" == "/fullsend" ]]; then
                      SECOND_WORD="$(printf '%s\n' "${COMMENT_BODY}" | head -1 | tr -d '\r' | awk '{print $2}')"
                      if [[ "${SECOND_WORD}" == "retro" ]]; then
                        STAGE="retro"
                      fi
                    else
                      STAGE="retro"
                    fi
                  fi
                  ;;
                /fs-prioritize)
                  if [[ "${COMMENT_USER_TYPE}" != "Bot" ]] && is_authorized; then
                    STAGE="prioritize"
                  fi
                  ;;
                *)
                  # Intentionally weaker gate: allows external reporters to
                  # re-trigger triage by providing clarification on needs-info
                  # issues. Full write-permission check is not required here.
                  if has_label "needs-info" && ! has_label "feature"; then
                    if [[ "${COMMENT_USER_TYPE}" != "Bot" ]]; then
                      if [[ "${COMMENT_AUTHOR_ASSOC}" != "NONE" ]] || is_issue_author; then
                        STAGE="triage"
                      fi
                    fi
                  fi
                  ;;
              esac
              ;;

            issues)
              if [[ "${EVENT_ACTION}" == "opened" ]]; then
                if is_event_actor_authorized "${ISSUE_USER_LOGIN}"; then
                  STAGE="triage"
                fi
              elif [[ "${EVENT_ACTION}" == "edited" ]]; then
                if is_event_actor_authorized "${EVENT_SENDER_LOGIN}"; then
                  STAGE="triage"
                fi
              elif [[ "${EVENT_ACTION}" == "labeled" ]]; then
                if [[ "${TRIGGERING_LABEL}" == "ready-for-triage" ]]; then
                  STAGE="triage"
                elif [[ "${TRIGGERING_LABEL}" == "ready-to-code" ]]; then
                  STAGE="code"
                elif [[ "${TRIGGERING_LABEL}" == "ready-for-review" ]]; then
                  if [[ "${ISSUE_IS_PR}" == "true" ]]; then
                    STAGE="review"
                  fi
                fi
              fi
              ;;

            pull_request_target)
              case "${EVENT_ACTION}" in
                opened|synchronize|ready_for_review)
                  if is_event_actor_authorized "${PR_USER_LOGIN}"; then
                    STAGE="review"
                  fi
                  ;;
                closed)
                  STAGE="retro"
                  ;;
              esac
              ;;

            pull_request_review)
              if [[ "${EVENT_ACTION}" == "submitted" && "${REVIEW_STATE}" == "changes_requested" ]]; then
                REVIEW_BOT="${ORG_NAME}-review[bot]"
                if [[ "${REVIEW_USER_LOGIN}" == "${REVIEW_BOT}" ]]; then
                  if [[ -n "${PR_HEAD_REPO}" && -n "${PR_BASE_REPO}" ]]; then
                    if [[ "${PR_HEAD_REPO}" == "${PR_BASE_REPO}" ]]; then
                      if ! has_label "fullsend-no-fix" "${PR_LABELS}"; then
                        # Human PRs require the fullsend-fix label to auto-trigger
                        # the fix agent. The /fs-fix slash command (line ~129)
                        # intentionally bypasses this gate — authorized users can
                        # always trigger fix manually regardless of labels.
                        if [[ "${PR_USER_LOGIN}" =~ \[bot\]$ ]] || has_label "fullsend-fix" "${PR_LABELS}"; then
                          STAGE="fix"
                          TRIGGER_SOURCE="${REVIEW_USER_LOGIN}"
                        fi
                      fi
                    fi
                  fi
                fi
              fi
              ;;
          esac

          if [[ -z "${STAGE}" ]]; then
            echo "No stage matched — skipping dispatch"
            echo "stage=" >> "${GITHUB_OUTPUT}"
            exit 0
          fi

          echo "Routed to stage: ${STAGE}"
          echo "stage=${STAGE}" >> "${GITHUB_OUTPUT}"
          echo "trigger_source=${TRIGGER_SOURCE}" >> "${GITHUB_OUTPUT}"

      - name: Check for existing PRs
        id: pr-check
        if: steps.route.outputs.stage == 'code'
        env:
          GH_TOKEN: ${{ github.token }}
          ISSUE_NUMBER: ${{ github.event.issue.number }}
          SOURCE_REPO: ${{ github.repository }}
        run: |
          set -euo pipefail
          BOT_LOGIN="fullsend-ai[bot]"
          CODER_BOT_LOGIN="fullsend-ai-coder[bot]"
          MENTIONING_PRS="$(gh pr list --repo "${SOURCE_REPO}" --state open \
            --search "${ISSUE_NUMBER} in:title,body" \
            --json number,author \
            --jq "[.[] | select(.author.login != \"${BOT_LOGIN}\" and .author.login != \"${CODER_BOT_LOGIN}\")] | .[].number" \
            2>/dev/null || true)"
          if [[ -n "${MENTIONING_PRS}" ]]; then
            echo "::notice::Open PR(s) mentioning issue #${ISSUE_NUMBER} found — skipping code dispatch"
            echo "skipped=true" >> "${GITHUB_OUTPUT}"
          fi

      - name: Validate routed stage
        if: steps.route.outputs.stage != ''
        env:
          STAGE: ${{ steps.route.outputs.stage }}
          TRIGGER_SOURCE: ${{ steps.route.outputs.trigger_source }}
        run: |
          set -euo pipefail

          if [[ ! "$STAGE" =~ ^[a-z][a-z0-9_-]*$ ]]; then
            echo "::error::Invalid stage name: must start with lowercase letter and contain only [a-z0-9_-]"
            exit 1
          fi

          if [[ -n "${TRIGGER_SOURCE:-}" ]]; then
            if [[ ! "$TRIGGER_SOURCE" =~ ^[a-zA-Z0-9_-]+(\[bot\])?$ ]]; then
              echo "::error::Invalid trigger_source format: must be alphanumeric with optional [bot] suffix"
              exit 1
            fi
          fi

      - name: Check kill switch
        if: steps.route.outputs.stage != ''
        run: |
          set -euo pipefail
          if [[ -f .fullsend/config.yaml ]]; then
            KILL_SWITCH=$(yq '.kill_switch // false' .fullsend/config.yaml)
            if [[ "$KILL_SWITCH" == "true" ]]; then
              echo "::error::Kill switch is active — all agent dispatch halted"
              echo "::error::Set kill_switch: false in .fullsend/config.yaml to resume"
              exit 1
            fi
          fi

      - name: Check role is enabled
        id: role-check
        if: steps.route.outputs.stage != ''
        env:
          STAGE: ${{ steps.route.outputs.stage }}
        run: |
          set -euo pipefail
          if [[ ! -f .fullsend/config.yaml ]]; then
            exit 0
          fi
          STAGE_ROLE="$STAGE"
          case "$STAGE" in
            code|fix) STAGE_ROLE="coder" ;;
          esac
          ROLES=$(yq '.roles[]' .fullsend/config.yaml 2>/dev/null || echo "")
          if [[ -n "$ROLES" ]] && ! echo "$ROLES" | grep -Fqx "$STAGE_ROLE"; then
            # Backward compat: "fullsend" in roles implies retro + prioritize
            if [[ "$STAGE" =~ ^(retro|prioritize)$ ]] && echo "$ROLES" | grep -Fqx "fullsend"; then
              echo "::notice::Stage '$STAGE' allowed via 'fullsend' role — if customizing roles, add '$STAGE' explicitly"
            else
              echo "::notice::Stage '$STAGE' skipped — role '$STAGE_ROLE' not in configured roles"
              echo "skipped=true" >> "${GITHUB_OUTPUT}"
              exit 0
            fi
          fi

      - name: Block fork PRs for fix stage
        if: steps.route.outputs.stage == 'fix' && steps.role-check.outputs.skipped != 'true' && github.event.issue.pull_request
        env:
          GH_TOKEN: ${{ github.token }}
          SOURCE_REPO: ${{ github.repository }}
          PR_NUMBER: ${{ github.event.issue.number }}
        run: |
          set -euo pipefail
          REPOS=$(gh api "repos/$SOURCE_REPO/pulls/$PR_NUMBER" \
            --jq '[.head.repo.full_name, .base.repo.full_name] | @tsv' 2>/dev/null) || {
            echo "::error::Could not determine PR repos — blocking fix for safety"
            exit 1
          }
          HEAD_REPO=$(printf '%s' "$REPOS" | cut -f1)
          BASE_REPO=$(printf '%s' "$REPOS" | cut -f2)
          if [[ "$HEAD_REPO" != "$BASE_REPO" ]]; then
            echo "::error::Fork PR detected (head=$HEAD_REPO, base=$BASE_REPO) — fix agent blocked"
            exit 1
          fi

      - name: Build event payload
        id: payload
        if: steps.route.outputs.stage != ''
        run: |
          set -euo pipefail
          EVENT_PAYLOAD=$(jq -c '{
            issue: (.issue // null | if . then {number, html_url} else null end),
            pull_request: (.pull_request // null | if . then {number, html_url,
              head: {ref: .head.ref, sha: .head.sha, repo: {full_name: .head.repo.full_name}},
              base: {ref: .base.ref, repo: {full_name: .base.repo.full_name}}} else null end),
            comment: (.comment // null | if . then {body: .body[:4096]} else null end)
          }' "$GITHUB_EVENT_PATH") || {
            echo "::error::Failed to extract event payload from GITHUB_EVENT_PATH"
            exit 1
          }
          if [[ -z "${EVENT_PAYLOAD}" || "${EVENT_PAYLOAD}" == "null" ]]; then
            echo "::error::Event payload is empty after extraction"
            exit 1
          fi
          DELIM="PAYLOAD_$(openssl rand -hex 8)"
          {
            echo "event_payload<<${DELIM}"
            echo "${EVENT_PAYLOAD}"
            echo "${DELIM}"
          } >> "${GITHUB_OUTPUT}"

  triage:
    name: Triage
    needs: route
    if: needs.route.outputs.stage == 'triage'
    concurrency:
      group: fullsend-triage-${{ github.repository }}-${{ github.event.issue.number || github.event.pull_request.number }}
      cancel-in-progress: true
    # @v0 is hardcoded — GHA does not support expressions in uses:.
    # Stage workflows use job.workflow_sha to self-checkout upstream defaults.
    uses: fullsend-ai/fullsend/.github/workflows/reusable-triage.yml@v0
    with:
      event_type: ${{ github.event_name }}
      source_repo: ${{ github.repository }}
      event_payload: ${{ needs.route.outputs.event_payload }}
      install_mode: ${{ inputs.install_mode }}
      mint_url: ${{ inputs.mint_url }}
      gcp_region: ${{ inputs.gcp_region }}
      fullsend_version: ${{ inputs.fullsend_version }}
      runner_image: ${{ inputs.runner_image }}
    secrets:
      FULLSEND_GCP_WIF_PROVIDER: ${{ secrets.FULLSEND_GCP_WIF_PROVIDER }}
      FULLSEND_GCP_PROJECT_ID: ${{ secrets.FULLSEND_GCP_PROJECT_ID }}

  code:
    name: Code
    needs: route
    if: needs.route.outputs.stage == 'code'
    concurrency:
      group: fullsend-code-${{ github.repository }}-${{ github.event.issue.number || github.event.pull_request.number }}
      cancel-in-progress: true
    uses: fullsend-ai/fullsend/.github/workflows/reusable-code.yml@v0
    with:
      event_type: ${{ github.event_name }}
      source_repo: ${{ github.repository }}
      event_payload: ${{ needs.route.outputs.event_payload }}
      install_mode: ${{ inputs.install_mode }}
      mint_url: ${{ inputs.mint_url }}
      gcp_region: ${{ inputs.gcp_region }}
      fullsend_version: ${{ inputs.fullsend_version }}
      runner_image: ${{ inputs.runner_image }}
    secrets:
      FULLSEND_GCP_WIF_PROVIDER: ${{ secrets.FULLSEND_GCP_WIF_PROVIDER }}
      FULLSEND_GCP_PROJECT_ID: ${{ secrets.FULLSEND_GCP_PROJECT_ID }}

  review:
    name: Review
    needs: route
    if: needs.route.outputs.stage == 'review'
    concurrency:
      group: fullsend-review-${{ github.repository }}-${{ github.event.pull_request.number || github.event.issue.number }}
      cancel-in-progress: true
    uses: fullsend-ai/fullsend/.github/workflows/reusable-review.yml@v0
    with:
      event_type: ${{ github.event_name }}
      source_repo: ${{ github.repository }}
      event_payload: ${{ needs.route.outputs.event_payload }}
      install_mode: ${{ inputs.install_mode }}
      mint_url: ${{ inputs.mint_url }}
      gcp_region: ${{ inputs.gcp_region }}
      fullsend_version: ${{ inputs.fullsend_version }}
      runner_image: ${{ inputs.runner_image }}
    secrets:
      FULLSEND_GCP_WIF_PROVIDER: ${{ secrets.FULLSEND_GCP_WIF_PROVIDER }}
      FULLSEND_GCP_PROJECT_ID: ${{ secrets.FULLSEND_GCP_PROJECT_ID }}

  fix:
    name: Fix
    needs: route
    if: needs.route.outputs.stage == 'fix'
    concurrency:
      group: fullsend-fix-${{ github.repository }}-${{ github.event.pull_request.number || github.event.issue.number }}
      cancel-in-progress: true
    uses: fullsend-ai/fullsend/.github/workflows/reusable-fix.yml@v0
    with:
      event_type: ${{ github.event_name }}
      source_repo: ${{ github.repository }}
      event_payload: ${{ needs.route.outputs.event_payload }}
      trigger_source: ${{ needs.route.outputs.trigger_source }}
      install_mode: ${{ inputs.install_mode }}
      mint_url: ${{ inputs.mint_url }}
      gcp_region: ${{ inputs.gcp_region }}
      fullsend_version: ${{ inputs.fullsend_version }}
      runner_image: ${{ inputs.runner_image }}
    secrets:
      FULLSEND_GCP_WIF_PROVIDER: ${{ secrets.FULLSEND_GCP_WIF_PROVIDER }}
      FULLSEND_GCP_PROJECT_ID: ${{ secrets.FULLSEND_GCP_PROJECT_ID }}

  retro:
    name: Retro
    needs: route
    if: needs.route.outputs.stage == 'retro'
    concurrency:
      group: fullsend-retro-${{ github.repository }}-${{ github.event.pull_request.number || github.event.issue.number }}
      cancel-in-progress: true
    uses: fullsend-ai/fullsend/.github/workflows/reusable-retro.yml@v0
    with:
      event_type: ${{ github.event_name }}
      source_repo: ${{ github.repository }}
      event_payload: ${{ needs.route.outputs.event_payload }}
      install_mode: ${{ inputs.install_mode }}
      mint_url: ${{ inputs.mint_url }}
      gcp_region: ${{ inputs.gcp_region }}
      fullsend_version: ${{ inputs.fullsend_version }}
      runner_image: ${{ inputs.runner_image }}
    secrets:
      FULLSEND_GCP_WIF_PROVIDER: ${{ secrets.FULLSEND_GCP_WIF_PROVIDER }}
      FULLSEND_GCP_PROJECT_ID: ${{ secrets.FULLSEND_GCP_PROJECT_ID }}

  prioritize:
    name: Prioritize
    needs: route
    if: needs.route.outputs.stage == 'prioritize'
    concurrency:
      group: fullsend-prioritize-${{ github.repository }}-${{ github.event.issue.number || github.event.pull_request.number }}
      cancel-in-progress: true
    uses: fullsend-ai/fullsend/.github/workflows/reusable-prioritize.yml@v0
    with:
      event_type: ${{ github.event_name }}
      source_repo: ${{ github.repository }}
      event_payload: ${{ needs.route.outputs.event_payload }}
      install_mode: ${{ inputs.install_mode }}
      mint_url: ${{ inputs.mint_url }}
      gcp_region: ${{ inputs.gcp_region }}
      project_number: ${{ inputs.project_number }}
      fullsend_version: ${{ inputs.fullsend_version }}
      runner_image: ${{ inputs.runner_image }}
    secrets:
      FULLSEND_GCP_WIF_PROVIDER: ${{ secrets.FULLSEND_GCP_WIF_PROVIDER }}
      FULLSEND_GCP_PROJECT_ID: ${{ secrets.FULLSEND_GCP_PROJECT_ID }}