fix(dispatch): address review feedback on workflow_call dispatch

- Per-org stage jobs: explicit OIDC permissions; kill-switch ternary fix
- Role mapping: code|fix → coder; prioritize workflow_call secrets
- Per-repo reusable-dispatch: prioritize job via .fullsend/prioritize.yml
- finding-agent-runs skill: dispatch.yml instead of removed thin workflows
- reusable-fix: fail closed when gh pr view fails (bot eligibility)
- pre-code-test: restore line-by-line extra_env parsing
- e2e: capture issueCreatedAt before issue creation

Signed-off-by: Barak Korren <bkorren@redhat.com>
Co-authored-by: Cursor <cursoragent@cursor.com>
Signed-off-by: Barak Korren <bkorren@redhat.com>
Co-authored-by: Cursor <cursoragent@cursor.com>

Author: ifireball

.github/workflows/reusable-dispatch.yml

@@ -49,7 +49,7 @@ jobs:
       contents: read
       pull-requests: read
     outputs:
-      stage: ${{ steps.role-check.outputs.skipped == 'true' && '' || steps.route.outputs.stage }}
+      stage: ${{ steps.role-check.outputs.skipped != 'true' && steps.route.outputs.stage || '' }}
       trigger_source: ${{ steps.route.outputs.trigger_source }}
       event_payload: ${{ steps.payload.outputs.event_payload }}
     steps:
@@ -413,3 +413,19 @@ jobs:
       FULLSEND_GCP_WIF_PROVIDER: ${{ secrets.FULLSEND_GCP_WIF_PROVIDER }}
 
       FULLSEND_GCP_PROJECT_ID: ${{ secrets.FULLSEND_GCP_PROJECT_ID }}
+
+  prioritize:
+    name: Prioritize
+    needs: route
+    if: needs.route.outputs.stage == 'prioritize'
+    uses: ./.fullsend/.github/workflows/prioritize.yml
+    permissions:
+      contents: read
+      id-token: write
+    with:
+      event_type: ${{ github.event_name }}
+      source_repo: ${{ github.repository }}
+      event_payload: ${{ needs.route.outputs.event_payload }}
+    secrets:
+      FULLSEND_GCP_WIF_PROVIDER: ${{ secrets.FULLSEND_GCP_WIF_PROVIDER }}
+      FULLSEND_GCP_PROJECT_ID: ${{ secrets.FULLSEND_GCP_PROJECT_ID }}

.github/workflows/reusable-fix.yml

@@ -259,8 +259,8 @@ jobs:
         run: |
           if [[ "${TRIGGER_SOURCE}" =~ \[bot\]$ ]]; then
             PR_INFO=$(gh pr view "${PR_NUM}" --repo "${SOURCE_REPO}" \
-              --json labels,author --jq '{labels: [.labels[].name], author: .author.login}' 2>/dev/null \
-              || echo '{"labels":[],"author":""}')
+              --json labels,author --jq '{labels: [.labels[].name], author: .author.login}') \
+              || { echo "::error::Failed to fetch PR info for #${PR_NUM}"; exit 1; }
 
             HAS_NO_FIX=$(echo "${PR_INFO}" | jq -r '.labels | any(. == "fullsend-no-fix")')
             if [[ "${HAS_NO_FIX}" == "true" ]]; then

.pre-commit-config.yaml

@@ -70,6 +70,8 @@ repos:
           - SC2016
           - -ignore
           - 'could not read reusable workflow file for "\./\.github/workflows/prioritize\.yml"'
+          - -ignore
+          - 'could not read reusable workflow file for "\./\.fullsend/\.github/workflows/prioritize\.yml"'
 
   - repo: local
     hooks:

e2e/admin/admin_test.go

@@ -250,6 +250,11 @@ func runTriageDispatchSmokeTest(t *testing.T, env *e2eEnv) {
 	t.Helper()
 	ctx := context.Background()
 
+	// Capture a lower-bound timestamp *before* creating the issue.
+	// The shim/dispatch workflows can start very quickly, and we only want to
+	// filter out runs from earlier test phases.
+	issueCreatedAt := time.Now()
+
 	// File a test issue to trigger the shim workflow.
 	issueTitle := fmt.Sprintf("e2e-triage-test-%s", env.runID)
 	issueBody := `## Bug Report
@@ -294,7 +299,6 @@ Files over 64KB save fine if they contain only ASCII characters.`
 	// Wait for dispatch.yml to run in .fullsend (shim → dispatch → reusable-triage).
 	// The shim fires on issues:opened and runs the triage stage synchronously.
 	// Filter by CreatedAt to avoid false positives from previous runs.
-	issueCreatedAt := time.Now()
 	t.Log("Waiting for dispatch workflow to run...")
 	var dispatchRun *forge.WorkflowRun
 	for attempt := 0; attempt < 12; attempt++ {

internal/scaffold/fullsend-repo/.github/workflows/dispatch.yml

@@ -25,13 +25,14 @@ jobs:
       contents: read
       pull-requests: read
     outputs:
-      stage: ${{ steps.role-check.outputs.skipped == 'true' && '' || steps.route.outputs.stage }}
+      stage: ${{ steps.role-check.outputs.skipped != 'true' && steps.route.outputs.stage || '' }}
       trigger_source: ${{ steps.route.outputs.trigger_source }}
       event_payload: ${{ steps.payload.outputs.event_payload }}
     steps:
       - name: Checkout config repository
         uses: actions/checkout@v6
         with:
+          repository: ${{ job.workflow_repository }}
           persist-credentials: false
           sparse-checkout: config.yaml
           sparse-checkout-cone-mode: false
@@ -231,7 +232,7 @@ jobs:
           set -euo pipefail
           STAGE_ROLE="$STAGE"
           case "$STAGE" in
-            code) STAGE_ROLE="coder" ;;
+            code|fix) STAGE_ROLE="coder" ;;
             retro|prioritize) STAGE_ROLE="fullsend" ;;
           esac
 
@@ -292,6 +293,9 @@ jobs:
     name: Triage
     needs: route
     if: needs.route.outputs.stage == 'triage'
+    permissions:
+      contents: read
+      id-token: write
     uses: fullsend-ai/fullsend/.github/workflows/reusable-triage.yml@v0
     with:
       event_type: ${{ github.event_name }}
@@ -308,6 +312,9 @@ jobs:
     name: Code
     needs: route
     if: needs.route.outputs.stage == 'code'
+    permissions:
+      contents: read
+      id-token: write
     uses: fullsend-ai/fullsend/.github/workflows/reusable-code.yml@v0
     with:
       event_type: ${{ github.event_name }}
@@ -324,6 +331,9 @@ jobs:
     name: Review
     needs: route
     if: needs.route.outputs.stage == 'review'
+    permissions:
+      contents: read
+      id-token: write
     uses: fullsend-ai/fullsend/.github/workflows/reusable-review.yml@v0
     with:
       event_type: ${{ github.event_name }}
@@ -340,6 +350,9 @@ jobs:
     name: Fix
     needs: route
     if: needs.route.outputs.stage == 'fix'
+    permissions:
+      contents: read
+      id-token: write
     uses: fullsend-ai/fullsend/.github/workflows/reusable-fix.yml@v0
     with:
       event_type: ${{ github.event_name }}
@@ -357,6 +370,9 @@ jobs:
     name: Retro
     needs: route
     if: needs.route.outputs.stage == 'retro'
+    permissions:
+      contents: read
+      id-token: write
     uses: fullsend-ai/fullsend/.github/workflows/reusable-retro.yml@v0
     with:
       event_type: ${{ github.event_name }}
@@ -374,6 +390,12 @@ jobs:
     needs: route
     if: needs.route.outputs.stage == 'prioritize'
     uses: ./.github/workflows/prioritize.yml
+    permissions:
+      contents: read
+      id-token: write
+    secrets:
+      FULLSEND_GCP_WIF_PROVIDER: ${{ secrets.FULLSEND_GCP_WIF_PROVIDER }}
+      FULLSEND_GCP_PROJECT_ID: ${{ secrets.FULLSEND_GCP_PROJECT_ID }}
     with:
       event_type: ${{ github.event_name }}
       source_repo: ${{ github.repository }}

internal/scaffold/fullsend-repo/.github/workflows/prioritize.yml

@@ -12,6 +12,11 @@ on:
       event_payload:
         required: true
         type: string
+    secrets:
+      FULLSEND_GCP_WIF_PROVIDER:
+        required: true
+      FULLSEND_GCP_PROJECT_ID:
+        required: true
   workflow_dispatch:
     inputs:
       event_type:

internal/scaffold/fullsend-repo/scripts/pre-code-test.sh

@@ -86,11 +86,11 @@ run_test() {
     GH_TOKEN="fake-token"
   )
 
-  # Add extra env vars if provided.
+  # Add extra env vars if provided (read line-by-line to support values with spaces).
   if [[ -n "${extra_env}" ]]; then
-    for kv in ${extra_env}; do
-      env_cmd+=("${kv}")
-    done
+    while IFS= read -r kv; do
+      [[ -n "${kv}" ]] && env_cmd+=("${kv}")
+    done <<< "${extra_env}"
   fi
 
   local exit_code=0
@@ -139,9 +139,9 @@ run_test_stdout() {
   )
 
   if [[ -n "${extra_env}" ]]; then
-    for kv in ${extra_env}; do
-      env_cmd+=("${kv}")
-    done
+    while IFS= read -r kv; do
+      [[ -n "${kv}" ]] && env_cmd+=("${kv}")
+    done <<< "${extra_env}"
   fi
 
   local exit_code=0

internal/scaffold/fullsend-repo/skills/finding-agent-runs/SKILL.md

@@ -81,7 +81,7 @@ gh run list --workflow=fullsend.yaml \
 Confirm `dispatch-review completed/success`, then find the run:
 
 ```bash
-gh run list --repo "${DISPATCH_REPO}" --workflow=review.yml --limit 5 \
+gh run list --repo "${DISPATCH_REPO}" --workflow=dispatch.yml --limit 5 \
   --json databaseId,status,conclusion,createdAt
 ```
 
@@ -99,7 +99,7 @@ gh run list --workflow=fullsend.yaml \
 Find the actual retro agent run:
 
 ```bash
-gh run list --repo "${DISPATCH_REPO}" --workflow=retro.yml --limit 5 \
+gh run list --repo "${DISPATCH_REPO}" --workflow=dispatch.yml --limit 5 \
   --json databaseId,status,conclusion,createdAt
 ```
 

internal/scaffold/scaffold_test.go

@@ -231,6 +231,9 @@ func TestDispatchWorkflowContent(t *testing.T) {
 	assert.Contains(t, s, "install_mode: per-org")
 	assert.Contains(t, s, "permissions: {}")
 	assert.Contains(t, s, "sparse-checkout: config.yaml")
+	assert.Contains(t, s, "repository: ${{ job.workflow_repository }}")
+	assert.Contains(t, s, "FULLSEND_GCP_WIF_PROVIDER")
+	assert.Contains(t, s, "FULLSEND_GCP_PROJECT_ID")
 	assert.Contains(t, s, "set -euo pipefail")
 	assert.Contains(t, s, "Invalid stage name")
 	assert.Contains(t, s, `^[a-z][a-z0-9_-]*$`)
@@ -389,14 +392,6 @@ func TestCodeAgentContent(t *testing.T) {
 	assert.Contains(t, s, "code-implementation")
 }
 
-func TestCodeImplementationSkillAPIContractGuidance(t *testing.T) {
-	content, err := FullsendRepoFile("skills/code-implementation/SKILL.md")
-	require.NoError(t, err)
-	s := string(content)
-	assert.Contains(t, s, "Verify API contracts per code path")
-	assert.Contains(t, s, "or changes a parameter sent to an external API")
-}
-
 func TestSetupGcpActionContent(t *testing.T) {
 	content, err := FullsendRepoFile(".github/actions/setup-gcp/action.yml")
 	require.NoError(t, err)