fix(dispatch): address review feedback on workflow_call dispatch

- Per-org stage jobs: explicit OIDC permissions; kill-switch ternary fix
- Role mapping: code|fix → coder; prioritize workflow_call secrets
- Per-repo reusable-dispatch: prioritize job via .fullsend/prioritize.yml
- finding-agent-runs skill: dispatch.yml instead of removed thin workflows
- reusable-fix: fail closed when gh pr view fails (bot eligibility)
- pre-code-test: restore line-by-line extra_env parsing
- e2e: capture issueCreatedAt before issue creation

Signed-off-by: Barak Korren <bkorren@redhat.com>
Co-authored-by: Cursor <cursoragent@cursor.com>
Signed-off-by: Barak Korren <bkorren@redhat.com>
Co-authored-by: Cursor <cursoragent@cursor.com>
Signed-off-by: Barak Korren <bkorren@redhat.com>
Co-authored-by: Cursor <cursoragent@cursor.com>

Author: ifireball

.github/workflows/reusable-dispatch.yml

@@ -49,7 +49,7 @@ jobs:
       contents: read
       pull-requests: read
     outputs:
-      stage: ${{ steps.role-check.outputs.skipped == 'true' && '' || steps.route.outputs.stage }}
+      stage: ${{ steps.role-check.outputs.skipped != 'true' && steps.route.outputs.stage || '' }}
       trigger_source: ${{ steps.route.outputs.trigger_source }}
       event_payload: ${{ steps.payload.outputs.event_payload }}
     steps:
@@ -413,3 +413,19 @@ jobs:
       FULLSEND_GCP_WIF_PROVIDER: ${{ secrets.FULLSEND_GCP_WIF_PROVIDER }}
 
       FULLSEND_GCP_PROJECT_ID: ${{ secrets.FULLSEND_GCP_PROJECT_ID }}
+
+  prioritize:
+    name: Prioritize
+    needs: route
+    if: needs.route.outputs.stage == 'prioritize'
+    uses: ./.fullsend/.github/workflows/prioritize.yml
+    permissions:
+      contents: read
+      id-token: write
+    with:
+      event_type: ${{ github.event_name }}
+      source_repo: ${{ github.repository }}
+      event_payload: ${{ needs.route.outputs.event_payload }}
+    secrets:
+      FULLSEND_GCP_WIF_PROVIDER: ${{ secrets.FULLSEND_GCP_WIF_PROVIDER }}
+      FULLSEND_GCP_PROJECT_ID: ${{ secrets.FULLSEND_GCP_PROJECT_ID }}

.github/workflows/reusable-fix.yml

@@ -259,8 +259,8 @@ jobs:
         run: |
           if [[ "${TRIGGER_SOURCE}" =~ \[bot\]$ ]]; then
             PR_INFO=$(gh pr view "${PR_NUM}" --repo "${SOURCE_REPO}" \
-              --json labels,author --jq '{labels: [.labels[].name], author: .author.login}' 2>/dev/null \
-              || echo '{"labels":[],"author":""}')
+              --json labels,author --jq '{labels: [.labels[].name], author: .author.login}') \
+              || { echo "::error::Failed to fetch PR info for #${PR_NUM}"; exit 1; }
 
             HAS_NO_FIX=$(echo "${PR_INFO}" | jq -r '.labels | any(. == "fullsend-no-fix")')
             if [[ "${HAS_NO_FIX}" == "true" ]]; then

.pre-commit-config.yaml

@@ -70,6 +70,8 @@ repos:
           - SC2016
           - -ignore
           - 'could not read reusable workflow file for "\./\.github/workflows/prioritize\.yml"'
+          - -ignore
+          - 'could not read reusable workflow file for "\./\.fullsend/\.github/workflows/prioritize\.yml"'
 
   - repo: local
     hooks:

e2e/admin/admin_test.go

@@ -250,6 +250,11 @@ func runTriageDispatchSmokeTest(t *testing.T, env *e2eEnv) {
 	t.Helper()
 	ctx := context.Background()
 
+	// Capture a lower-bound timestamp *before* creating the issue.
+	// The shim/dispatch workflows can start very quickly, and we only want to
+	// filter out runs from earlier test phases.
+	issueCreatedAt := time.Now()
+
 	// File a test issue to trigger the shim workflow.
 	issueTitle := fmt.Sprintf("e2e-triage-test-%s", env.runID)
 	issueBody := `## Bug Report
@@ -291,15 +296,14 @@ Files over 64KB save fine if they contain only ASCII characters.`
 		}
 	})
 
-	// Wait for dispatch.yml to run in .fullsend (shim → dispatch → reusable-triage).
-	// The shim fires on issues:opened and runs the triage stage synchronously.
-	// Filter by CreatedAt to avoid false positives from previous runs.
-	issueCreatedAt := time.Now()
-	t.Log("Waiting for dispatch workflow to run...")
-	var dispatchRun *forge.WorkflowRun
+	// Wait for the enrolled-repo shim (fullsend.yaml). Cross-repo workflow_call
+	// runs appear on the caller repo, not as separate dispatch.yml runs in .fullsend.
+	// Chain: fullsend.yaml → .fullsend/dispatch.yml → reusable-triage (sync).
+	t.Log("Waiting for fullsend shim workflow to run...")
+	var shimRun *forge.WorkflowRun
 	for attempt := 0; attempt < 12; attempt++ {
 		time.Sleep(5 * time.Second)
-		runs, listErr := env.client.ListWorkflowRuns(ctx, env.org, forge.ConfigRepoName, "dispatch.yml")
+		runs, listErr := env.client.ListWorkflowRuns(ctx, env.org, testRepo, "fullsend.yaml")
 		if listErr != nil {
 			t.Logf("Attempt %d: error listing workflow runs: %v", attempt+1, listErr)
 			continue
@@ -316,24 +320,24 @@ Files over 64KB save fine if they contain only ASCII characters.`
 			}
 			t.Logf("Attempt %d: found run %d (status: %s, conclusion: %s, created: %s)", attempt+1, run.ID, run.Status, run.Conclusion, run.CreatedAt)
 			r := run // avoid loop variable capture
-			dispatchRun = &r
+			shimRun = &r
 			break
 		}
-		if dispatchRun != nil {
+		if shimRun != nil {
 			break
 		}
-		t.Logf("Attempt %d: no dispatch workflow runs found yet", attempt+1)
+		t.Logf("Attempt %d: no fullsend shim workflow runs found yet", attempt+1)
 	}
-	require.NotNil(t, dispatchRun, "dispatch workflow should have run in .fullsend repo")
+	require.NotNil(t, shimRun, "fullsend shim workflow should have run in enrolled repo")
 
 	// Wait for the workflow run to complete (up to 12 minutes: 10-minute agent
 	// timeout + sandbox setup overhead).
-	t.Logf("Waiting for dispatch workflow run %d to complete...", dispatchRun.ID)
+	t.Logf("Waiting for fullsend shim workflow run %d to complete...", shimRun.ID)
 	var finalRun *forge.WorkflowRun
 	deadline := time.Now().Add(12 * time.Minute)
 	for time.Now().Before(deadline) {
 		time.Sleep(15 * time.Second)
-		run, getErr := env.client.GetWorkflowRun(ctx, env.org, forge.ConfigRepoName, dispatchRun.ID)
+		run, getErr := env.client.GetWorkflowRun(ctx, env.org, testRepo, shimRun.ID)
 		if getErr != nil {
 			t.Logf("Error polling workflow run: %v", getErr)
 			continue
@@ -344,34 +348,34 @@ Files over 64KB save fine if they contain only ASCII characters.`
 			break
 		}
 	}
-	require.NotNil(t, finalRun, "dispatch workflow run should have completed within deadline")
+	require.NotNil(t, finalRun, "fullsend shim workflow run should have completed within deadline")
 
 	// If the run failed, save logs and artifacts for debugging.
 	if finalRun.Conclusion != "success" {
-		runURL := fmt.Sprintf("https://github.com/%s/%s/actions/runs/%d", env.org, forge.ConfigRepoName, finalRun.ID)
-		fmt.Fprintf(os.Stderr, "::notice::Dispatch workflow run %d failed (conclusion: %s). Downloading debug artifacts. Run URL: %s\n", finalRun.ID, finalRun.Conclusion, runURL)
+		runURL := fmt.Sprintf("https://github.com/%s/%s/actions/runs/%d", env.org, testRepo, finalRun.ID)
+		fmt.Fprintf(os.Stderr, "::notice::Fullsend shim run %d failed (conclusion: %s). Downloading debug artifacts. Run URL: %s\n", finalRun.ID, finalRun.Conclusion, runURL)
 
-		debugDir := filepath.Join(env.screenshotDir, fmt.Sprintf("dispatch-run-%d", finalRun.ID))
+		debugDir := filepath.Join(env.screenshotDir, fmt.Sprintf("fullsend-run-%d", finalRun.ID))
 		_ = os.MkdirAll(debugDir, 0o755)
 
 		// Save workflow logs.
-		logs, logErr := env.client.GetWorkflowRunLogs(ctx, env.org, forge.ConfigRepoName, finalRun.ID)
+		logs, logErr := env.client.GetWorkflowRunLogs(ctx, env.org, testRepo, finalRun.ID)
 		if logErr != nil {
 			t.Logf("Could not fetch run logs: %v", logErr)
 		} else {
 			logPath := filepath.Join(debugDir, "workflow-logs.txt")
 			if writeErr := os.WriteFile(logPath, []byte(logs), 0o644); writeErr != nil {
 				t.Logf("Could not write logs to %s: %v", logPath, writeErr)
 			} else {
-				fmt.Fprintf(os.Stderr, "::notice file=%s::Dispatch run %d workflow logs saved\n", logPath, finalRun.ID)
+				fmt.Fprintf(os.Stderr, "::notice file=%s::Fullsend shim run %d workflow logs saved\n", logPath, finalRun.ID)
 			}
 			t.Logf("Workflow run logs:\n%s", logs)
 		}
 
 		// Download run artifacts (transcripts, etc).
-		downloadRunArtifacts(ctx, env.token, env.org, forge.ConfigRepoName, finalRun.ID, debugDir, t)
+		downloadRunArtifacts(ctx, env.token, env.org, testRepo, finalRun.ID, debugDir, t)
 
-		t.Fatalf("Dispatch workflow run %d concluded with %q, expected success. Debug artifacts saved to %s", finalRun.ID, finalRun.Conclusion, debugDir)
+		t.Fatalf("Fullsend shim workflow run %d concluded with %q, expected success. Debug artifacts saved to %s", finalRun.ID, finalRun.Conclusion, debugDir)
 	}
 
 	// Verify the triage agent posted a comment on the issue.

internal/scaffold/fullsend-repo/.github/workflows/dispatch.yml

@@ -25,13 +25,14 @@ jobs:
       contents: read
       pull-requests: read
     outputs:
-      stage: ${{ steps.role-check.outputs.skipped == 'true' && '' || steps.route.outputs.stage }}
+      stage: ${{ steps.role-check.outputs.skipped != 'true' && steps.route.outputs.stage || '' }}
       trigger_source: ${{ steps.route.outputs.trigger_source }}
       event_payload: ${{ steps.payload.outputs.event_payload }}
     steps:
       - name: Checkout config repository
         uses: actions/checkout@v6
         with:
+          repository: ${{ job.workflow_repository }}
           persist-credentials: false
           sparse-checkout: config.yaml
           sparse-checkout-cone-mode: false
@@ -231,7 +232,7 @@ jobs:
           set -euo pipefail
           STAGE_ROLE="$STAGE"
           case "$STAGE" in
-            code) STAGE_ROLE="coder" ;;
+            code|fix) STAGE_ROLE="coder" ;;
             retro|prioritize) STAGE_ROLE="fullsend" ;;
           esac
 
@@ -292,6 +293,9 @@ jobs:
     name: Triage
     needs: route
     if: needs.route.outputs.stage == 'triage'
+    permissions:
+      contents: read
+      id-token: write
     uses: fullsend-ai/fullsend/.github/workflows/reusable-triage.yml@v0
     with:
       event_type: ${{ github.event_name }}
@@ -308,6 +312,9 @@ jobs:
     name: Code
     needs: route
     if: needs.route.outputs.stage == 'code'
+    permissions:
+      contents: read
+      id-token: write
     uses: fullsend-ai/fullsend/.github/workflows/reusable-code.yml@v0
     with:
       event_type: ${{ github.event_name }}
@@ -324,6 +331,9 @@ jobs:
     name: Review
     needs: route
     if: needs.route.outputs.stage == 'review'
+    permissions:
+      contents: read
+      id-token: write
     uses: fullsend-ai/fullsend/.github/workflows/reusable-review.yml@v0
     with:
       event_type: ${{ github.event_name }}
@@ -340,6 +350,9 @@ jobs:
     name: Fix
     needs: route
     if: needs.route.outputs.stage == 'fix'
+    permissions:
+      contents: read
+      id-token: write
     uses: fullsend-ai/fullsend/.github/workflows/reusable-fix.yml@v0
     with:
       event_type: ${{ github.event_name }}
@@ -357,6 +370,9 @@ jobs:
     name: Retro
     needs: route
     if: needs.route.outputs.stage == 'retro'
+    permissions:
+      contents: read
+      id-token: write
     uses: fullsend-ai/fullsend/.github/workflows/reusable-retro.yml@v0
     with:
       event_type: ${{ github.event_name }}
@@ -374,6 +390,12 @@ jobs:
     needs: route
     if: needs.route.outputs.stage == 'prioritize'
     uses: ./.github/workflows/prioritize.yml
+    permissions:
+      contents: read
+      id-token: write
+    secrets:
+      FULLSEND_GCP_WIF_PROVIDER: ${{ secrets.FULLSEND_GCP_WIF_PROVIDER }}
+      FULLSEND_GCP_PROJECT_ID: ${{ secrets.FULLSEND_GCP_PROJECT_ID }}
     with:
       event_type: ${{ github.event_name }}
       source_repo: ${{ github.repository }}

internal/scaffold/fullsend-repo/.github/workflows/prioritize.yml

@@ -12,6 +12,11 @@ on:
       event_payload:
         required: true
         type: string
+    secrets:
+      FULLSEND_GCP_WIF_PROVIDER:
+        required: true
+      FULLSEND_GCP_PROJECT_ID:
+        required: true
   workflow_dispatch:
     inputs:
       event_type:

internal/scaffold/fullsend-repo/scripts/pre-code-test.sh

@@ -86,11 +86,11 @@ run_test() {
     GH_TOKEN="fake-token"
   )
 
-  # Add extra env vars if provided.
+  # Add extra env vars if provided (read line-by-line to support values with spaces).
   if [[ -n "${extra_env}" ]]; then
-    for kv in ${extra_env}; do
-      env_cmd+=("${kv}")
-    done
+    while IFS= read -r kv; do
+      [[ -n "${kv}" ]] && env_cmd+=("${kv}")
+    done <<< "${extra_env}"
   fi
 
   local exit_code=0
@@ -139,9 +139,9 @@ run_test_stdout() {
   )
 
   if [[ -n "${extra_env}" ]]; then
-    for kv in ${extra_env}; do
-      env_cmd+=("${kv}")
-    done
+    while IFS= read -r kv; do
+      [[ -n "${kv}" ]] && env_cmd+=("${kv}")
+    done <<< "${extra_env}"
   fi
 
   local exit_code=0

internal/scaffold/fullsend-repo/skills/finding-agent-runs/SKILL.md

@@ -81,7 +81,7 @@ gh run list --workflow=fullsend.yaml \
 Confirm `dispatch-review completed/success`, then find the run:
 
 ```bash
-gh run list --repo "${DISPATCH_REPO}" --workflow=review.yml --limit 5 \
+gh run list --repo "${DISPATCH_REPO}" --workflow=dispatch.yml --limit 5 \
   --json databaseId,status,conclusion,createdAt
 ```
 
@@ -99,7 +99,7 @@ gh run list --workflow=fullsend.yaml \
 Find the actual retro agent run:
 
 ```bash
-gh run list --repo "${DISPATCH_REPO}" --workflow=retro.yml --limit 5 \
+gh run list --repo "${DISPATCH_REPO}" --workflow=dispatch.yml --limit 5 \
   --json databaseId,status,conclusion,createdAt
 ```
 

internal/scaffold/scaffold_test.go

@@ -231,6 +231,9 @@ func TestDispatchWorkflowContent(t *testing.T) {
 	assert.Contains(t, s, "install_mode: per-org")
 	assert.Contains(t, s, "permissions: {}")
 	assert.Contains(t, s, "sparse-checkout: config.yaml")
+	assert.Contains(t, s, "repository: ${{ job.workflow_repository }}")
+	assert.Contains(t, s, "FULLSEND_GCP_WIF_PROVIDER")
+	assert.Contains(t, s, "FULLSEND_GCP_PROJECT_ID")
 	assert.Contains(t, s, "set -euo pipefail")
 	assert.Contains(t, s, "Invalid stage name")
 	assert.Contains(t, s, `^[a-z][a-z0-9_-]*$`)
@@ -389,14 +392,6 @@ func TestCodeAgentContent(t *testing.T) {
 	assert.Contains(t, s, "code-implementation")
 }
 
-func TestCodeImplementationSkillAPIContractGuidance(t *testing.T) {
-	content, err := FullsendRepoFile("skills/code-implementation/SKILL.md")
-	require.NoError(t, err)
-	s := string(content)
-	assert.Contains(t, s, "Verify API contracts per code path")
-	assert.Contains(t, s, "or changes a parameter sent to an external API")
-}
-
 func TestSetupGcpActionContent(t *testing.T) {
 	content, err := FullsendRepoFile(".github/actions/setup-gcp/action.yml")
 	require.NoError(t, err)