fix(#2045): use PR head SHA in status comment instead of GITHUB_SHA

In cross-repo workflow_dispatch mode, GITHUB_SHA points to the
.fullsend config repo's default branch HEAD, not the PR's actual
head commit. This made the status comment's "Commit:" line show
an unrelated SHA.

Two changes fix this:

1. dispatch.yml: Include pull_request.head.sha in the event
   payload that gets forwarded to agent workflows. Previously
   only head.ref and head.repo were extracted.

2. run.go: Add prHeadSHAFromEventPath() which reads the
   workflow_dispatch event file (GITHUB_EVENT_PATH), parses
   the nested event_payload JSON string, and extracts
   pull_request.head.sha. setupStatusNotifier() now prefers
   this value over GITHUB_SHA when available, falling back
   gracefully for non-PR events or direct triggers.

Note: pre-commit could not run in sandbox (gitleaks install
failed due to Go module cache permissions). The post-script
runs pre-commit authoritatively on the runner.

Closes #2045

Author: fullsend-ai-coder[bot]

internal/cli/run.go

@@ -1911,6 +1911,12 @@ func setupStatusNotifier(fullsendDir string, sOpts statusOpts, printer *ui.Print
 	client := gh.New(token)
 
 	sha := os.Getenv("GITHUB_SHA")
+	// In cross-repo workflow_dispatch mode, GITHUB_SHA is the dispatching
+	// repo's default branch HEAD — not the PR's head commit. Prefer the
+	// PR head SHA from the event payload when available. See #2045.
+	if prSHA := prHeadSHAFromEventPath(os.Getenv("GITHUB_EVENT_PATH")); prSHA != "" {
+		sha = prSHA
+	}
 	runID := os.Getenv("GITHUB_RUN_ID")
 	if runID == "" {
 		runID = fmt.Sprintf("%d", time.Now().UnixNano())
@@ -1922,3 +1928,37 @@ func setupStatusNotifier(fullsendDir string, sOpts statusOpts, printer *ui.Print
 	})
 	return n, nil
 }
+
+// prHeadSHAFromEventPath extracts pull_request.head.sha from the event
+// payload embedded in a workflow_dispatch event file. For workflow_dispatch
+// events, the file contains {"inputs": {"event_payload": "<json-string>"}}.
+// Returns empty string if the file is unreadable or the field is absent.
+func prHeadSHAFromEventPath(path string) string {
+	if path == "" {
+		return ""
+	}
+	data, err := os.ReadFile(path)
+	if err != nil {
+		return ""
+	}
+	// The workflow_dispatch event has inputs.event_payload as a JSON string.
+	var event struct {
+		Inputs struct {
+			EventPayload string `json:"event_payload"`
+		} `json:"inputs"`
+	}
+	if err := json.Unmarshal(data, &event); err != nil || event.Inputs.EventPayload == "" {
+		return ""
+	}
+	var payload struct {
+		PullRequest struct {
+			Head struct {
+				SHA string `json:"sha"`
+			} `json:"head"`
+		} `json:"pull_request"`
+	}
+	if err := json.Unmarshal([]byte(event.Inputs.EventPayload), &payload); err != nil {
+		return ""
+	}
+	return payload.PullRequest.Head.SHA
+}

internal/cli/run_test.go

@@ -1027,3 +1027,66 @@ func TestOpenTeeReader_FileCompleteOnParserError(t *testing.T) {
 	require.NoError(t, err)
 	assert.Equal(t, content, string(fileData), "file should contain all bytes including post-error drain")
 }
+
+func TestPRHeadSHAFromEventPath_WithSHA(t *testing.T) {
+	// Simulate a workflow_dispatch event file where the nested event_payload
+	// contains pull_request.head.sha.
+	eventJSON := `{
+		"inputs": {
+			"event_payload": "{\"pull_request\":{\"number\":42,\"head\":{\"ref\":\"feature\",\"sha\":\"abc123def\",\"repo\":{\"full_name\":\"org/repo\"}}}}"
+		}
+	}`
+	f := filepath.Join(t.TempDir(), "event.json")
+	require.NoError(t, os.WriteFile(f, []byte(eventJSON), 0o644))
+
+	got := prHeadSHAFromEventPath(f)
+	assert.Equal(t, "abc123def", got)
+}
+
+func TestPRHeadSHAFromEventPath_WithoutSHA(t *testing.T) {
+	// Event payload has pull_request but no head.sha — should return empty.
+	eventJSON := `{
+		"inputs": {
+			"event_payload": "{\"pull_request\":{\"number\":42,\"head\":{\"ref\":\"feature\",\"repo\":{\"full_name\":\"org/repo\"}}}}"
+		}
+	}`
+	f := filepath.Join(t.TempDir(), "event.json")
+	require.NoError(t, os.WriteFile(f, []byte(eventJSON), 0o644))
+
+	got := prHeadSHAFromEventPath(f)
+	assert.Empty(t, got)
+}
+
+func TestPRHeadSHAFromEventPath_NoPullRequest(t *testing.T) {
+	// Issue-only event — no pull_request in the payload.
+	eventJSON := `{
+		"inputs": {
+			"event_payload": "{\"issue\":{\"number\":99}}"
+		}
+	}`
+	f := filepath.Join(t.TempDir(), "event.json")
+	require.NoError(t, os.WriteFile(f, []byte(eventJSON), 0o644))
+
+	got := prHeadSHAFromEventPath(f)
+	assert.Empty(t, got)
+}
+
+func TestPRHeadSHAFromEventPath_EmptyPath(t *testing.T) {
+	got := prHeadSHAFromEventPath("")
+	assert.Empty(t, got)
+}
+
+func TestPRHeadSHAFromEventPath_MissingFile(t *testing.T) {
+	got := prHeadSHAFromEventPath("/nonexistent/path/event.json")
+	assert.Empty(t, got)
+}
+
+func TestPRHeadSHAFromEventPath_NoInputs(t *testing.T) {
+	// Direct event (not workflow_dispatch) — no inputs field.
+	eventJSON := `{"action": "opened", "pull_request": {"number": 1}}`
+	f := filepath.Join(t.TempDir(), "event.json")
+	require.NoError(t, os.WriteFile(f, []byte(eventJSON), 0o644))
+
+	got := prHeadSHAFromEventPath(f)
+	assert.Empty(t, got)
+}

internal/scaffold/fullsend-repo/.github/workflows/dispatch.yml

@@ -322,7 +322,7 @@ jobs:
           EVENT_PAYLOAD=$(jq -c '{
             issue: (.issue // null | if . then {number, html_url} else null end),
             pull_request: (.pull_request // null | if . then {number, html_url,
-              head: {ref: .head.ref, repo: {full_name: .head.repo.full_name}},
+              head: {ref: .head.ref, sha: .head.sha, repo: {full_name: .head.repo.full_name}},
               base: {ref: .base.ref, repo: {full_name: .base.repo.full_name}}} else null end),
             comment: (.comment // null | if . then {body: .body[:4096]} else null end)
           }' "$GITHUB_EVENT_PATH")