Merge branch 'main' into feat/keep-sandbox

Author: ralphbean

.github/workflows/pat-cleanup.yml

@@ -0,0 +1,45 @@
+# Delete expired classic PATs from the e2e test account (botsend).
+# Each e2e run creates a PAT and tries to clean it up, but crashed or
+# timed-out runs leave orphaned tokens that accumulate over time.
+
+name: Clean up expired PATs
+
+on:
+  schedule:
+    - cron: "0 4 * * 0" # Weekly on Sundays at 4am UTC
+  workflow_dispatch:
+
+concurrency:
+  group: pat-cleanup
+  cancel-in-progress: false
+
+permissions:
+  contents: read
+
+jobs:
+  cleanup:
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-go@v5
+        with:
+          go-version-file: go.mod
+
+      - name: Install Playwright browser and system dependencies
+        run: |
+          go run github.com/playwright-community/playwright-go/cmd/playwright install chromium
+          npx playwright install-deps chromium
+
+      - name: Decode session
+        run: |
+          SESSION_FILE="${RUNNER_TEMP}/github-session.json"
+          printf '%s' "$E2E_GITHUB_SESSION_B64" | base64 -d > "$SESSION_FILE"
+          chmod 600 "$SESSION_FILE"
+          echo "E2E_GITHUB_SESSION_FILE=${SESSION_FILE}" >> "$GITHUB_ENV"
+        env:
+          E2E_GITHUB_SESSION_B64: ${{ secrets.E2E_GITHUB_SESSION }}
+
+      - name: Delete expired PATs
+        run: go run hack/cleanup-pats.go

.github/workflows/reusable-code.yml

@@ -123,6 +123,7 @@ jobs:
           ISSUE_NUMBER: ${{ fromJSON(inputs.event_payload).issue.number }}
           REPO_FULL_NAME: ${{ inputs.source_repo }}
           GITHUB_ISSUE_URL: ${{ fromJSON(inputs.event_payload).issue.html_url }}
+          COMMENT_BODY: ${{ fromJSON(inputs.event_payload).comment.body }}
         run: bash scripts/pre-code.sh
 
       - name: Setup GCP and prepare credentials

.github/workflows/reusable-dispatch.yml

@@ -164,7 +164,9 @@ jobs:
               ;;
 
             issues)
-              if [[ "${EVENT_ACTION}" == "labeled" ]]; then
+              if [[ "${EVENT_ACTION}" == "opened" || "${EVENT_ACTION}" == "edited" ]]; then
+                STAGE="triage"
+              elif [[ "${EVENT_ACTION}" == "labeled" ]]; then
                 if [[ "${TRIGGERING_LABEL}" == "ready-to-code" ]]; then
                   STAGE="code"
                 elif [[ "${TRIGGERING_LABEL}" == "ready-for-review" ]]; then

.github/workflows/reusable-fix.yml

@@ -247,8 +247,8 @@ jobs:
         run: |
           if [[ "${TRIGGER_SOURCE}" =~ \[bot\]$ ]]; then
             PR_INFO=$(gh pr view "${PR_NUM}" --repo "${SOURCE_REPO}" \
-              --json labels,author --jq '{labels: [.labels[].name], author: .author.login}' 2>/dev/null \
-              || echo '{"labels":[],"author":""}')
+              --json labels,author --jq '{labels: [.labels[].name], author: .author.login}') \
+              || { echo "::error::Failed to fetch PR info for #${PR_NUM}"; exit 1; }
 
             HAS_NO_FIX=$(echo "${PR_INFO}" | jq -r '.labels | any(. == "fullsend-no-fix")')
             if [[ "${HAS_NO_FIX}" == "true" ]]; then

.pre-commit-config.yaml

@@ -9,7 +9,7 @@ repos:
       - id: end-of-file-fixer
       - id: trailing-whitespace
       - id: detect-private-key
-        exclude: "internal/layers/secrets_test\\.go$|internal/security/scanner_test\\.go$|internal/dispatch/gcf/provisioner_test\\.go$|tests/.*test_.*\\.py$"
+        exclude: "internal/layers/secrets_test\\.go$|internal/security/scanner_test\\.go$|internal/dispatch/gcf/provisioner_test\\.go$|internal/cli/mint_test\\.go$|tests/.*test_.*\\.py$"
       - id: check-added-large-files
         args: ["--maxkb=1000"]
       - id: check-merge-conflict
@@ -51,6 +51,12 @@ repos:
     hooks:
       - id: gitleaks
 
+  - repo: https://github.com/shellcheck-py/shellcheck-py
+    rev: v0.10.0.1
+    hooks:
+      - id: shellcheck
+        args: ["-x", "-e", "SC1091,SC2001,SC2016"]
+
   - repo: https://github.com/rhysd/actionlint
     rev: v1.7.11
     hooks:

AGENTS.md

@@ -25,3 +25,13 @@ All git forge operations (GitHub API calls, PR comments, issue creation, workflo
 **When writing code:** If you need a forge operation that `forge.Client` does not yet support, add a new method to the interface and implement it in the GitHub client — do not work around the interface.
 
 **When reviewing PRs:** Flag any direct `exec.Command("gh", ...)`, raw GitHub API calls, or other forge-specific operations outside `internal/forge/github/` as a medium-severity or higher finding. This is an architectural violation, not a style preference.
+
+## Architecture Decision Records (ADRs)
+
+These rules apply whenever you touch `docs/ADRs/` or review a PR that does. Full authoring guidance is in [`skills/writing-adrs/SKILL.md`](skills/writing-adrs/SKILL.md); invoke that skill when writing a new ADR.
+
+**Immutability:** Once an ADR on `main` has status **Accepted**, its Context, Decision, and Consequences sections are frozen. Do not add post-decision notes, rewrite rationale, or edit consequences in place. When circumstances change, write a **new** ADR that supersedes the old one. The only acceptable edits to an Accepted ADR on `main` are status changes (e.g., to Deprecated or Superseded) and links to the superseding ADR. Typos and broken links are narrow exceptions — call them out in the PR description.
+
+**New ADRs in pull requests:** Approval happens at **merge**, not when the branch is created. If the decision is made, set status to **Accepted** in the ADR you are proposing (not **Proposed** merely because the PR is open). Use **Proposed** or **Undecided** only when the decision itself is still unsettled. When status is Accepted, update `docs/architecture.md` and related problem docs in the same PR per the writing-adrs skill.
+
+**When reviewing PRs:** Flag in-place edits to Context, Decision, or Consequences on Accepted ADRs already on `main` as a policy violation. Allow status-only updates and supersession links. For brand-new ADR files on the PR branch, evaluate whether the recorded decision matches the diff — do not treat **Accepted** on a new file as a mistake if the ADR is ready for human review at merge.

Makefile

@@ -25,7 +25,7 @@ help:
 	@echo "  go-vet               - Run go vet"
 	@echo "  go-tidy              - Run go mod tidy"
 	@echo "  lint-md-links        - Check markdown files for broken in-repo links and anchors"
-	@echo "  script-test          - Run shell script tests (post-triage, post-code, post-review, reconcile-repos, validate-output-schema)"
+	@echo "  script-test          - Run shell script tests (post-triage, post-code, post-review, pre-fetch-prior-review, reconcile-repos, validate-output-schema)"
 	@echo "  test                 - Run all checks: lint-all, go-test, script-test"
 	@echo "  e2e-test             - Run admin e2e tests (requires E2E_GITHUB_SESSION_FILE or E2E_GITHUB_USERNAME + E2E_GITHUB_PASSWORD)"
 	@echo "  e2e-export-session   - Login to GitHub and export a Playwright session file"
@@ -113,6 +113,7 @@ script-test:
 	bash internal/scaffold/fullsend-repo/scripts/reconcile-repos-test.sh
 	bash internal/scaffold/fullsend-repo/scripts/validate-output-schema-test.sh
 	bash internal/scaffold/fullsend-repo/scripts/pre-code-test.sh
+	bash internal/scaffold/fullsend-repo/scripts/pre-fetch-prior-review-test.sh
 	python3 internal/scaffold/fullsend-repo/scripts/process-fix-result-test.py
 	python3 skills/topissues/scripts/topissues_test.py
 

README.md

@@ -67,7 +67,7 @@ If you're applying fullsend to your own organization, consider adding your speci
 | A question, bug, or small suggestion | **File an issue** — lowest friction, can graduate later. |
 | A new problem area no existing doc covers | **Create a problem doc** in `docs/problems/` and link it here. |
 | More to say about an existing problem area | **Expand the existing problem doc.** |
-| A specific decision that needs a yes-or-no answer | **Propose an ADR** in `docs/ADRs/` — even with only one option, file it as `Undecided` ([see ADR 0001](docs/ADRs/0001-use-adrs-for-decision-making.md)). |
+| A specific decision that needs a yes-or-no answer | **Propose an ADR** in `docs/ADRs/` via a pull request ([see ADR 0001](docs/ADRs/0001-use-adrs-for-decision-making.md)). |
 
 When in doubt, start with an issue.
 

docs/ADRs/0000-adr-template.md

@@ -1,6 +1,6 @@
 ---
 title: "NUMBER. TITLE"
-status: Proposed  # Valid values: Proposed, Undecided, Accepted, Deprecated, Superseded
+status: Accepted  # Valid values: Accepted, Deprecated, Superseded
 relates_to:
   - problem-doc-name  # filename without .md from docs/problems/
 topics:
@@ -13,7 +13,7 @@ Date: YYYY-MM-DD
 
 ## Status
 
-{Proposed | Undecided | Accepted | Deprecated | Superseded}
+{Accepted | Deprecated | Superseded}
 
 <!-- Once this ADR is Accepted, its content is frozen. Do not edit the Context,
      Decision, or Consequences sections. If circumstances change, write a new
@@ -27,18 +27,13 @@ What is the issue that we're seeing that motivates this decision or change?
 ## Options
 
 _Optional. Include only when there are genuine alternatives worth documenting.
-For Undecided ADRs, describe the options under consideration without choosing
-one yet. For Proposed or Accepted ADRs, include only if the rejected
-alternatives add useful context. If the decision is obvious, skip this
-section._
+For Accepted ADRs, include only if the rejected alternatives add useful
+context. If the decision is obvious, skip this section._
 
 ## Decision
 
-_Leave blank for Undecided ADRs._ What is the change that we're proposing
-and/or doing?
+What is the change that we're proposing and/or doing?
 
 ## Consequences
 
 What becomes easier or more difficult to do because of this change?
-For Undecided ADRs, describe consequences that apply regardless of which option
-is chosen, or leave blank.

docs/ADRs/0001-use-adrs-for-decision-making.md

@@ -41,21 +41,10 @@ ADRs live in `docs/ADRs/` and follow the naming convention
 
 Each ADR has a Status field. Valid statuses are:
 
-- **Proposed** -- A decision has been drafted but not yet discussed or agreed
-  upon.
-- **Undecided** -- The problem is identified, options are described, but no
-  decision has been made yet. These ADRs can be merged and iterated on. They
-  must include an Options section describing the alternatives under
-  consideration.
 - **Accepted** -- The decision has been made.
 - **Deprecated** -- The decision is no longer relevant.
 - **Superseded** -- The decision has been replaced by a later ADR.
 
-The Undecided status is a deliberate part of our workflow. It lets us merge ADRs
-that frame a decision and its options, so the community can discuss and refine
-the options over time without pressure to decide prematurely. When consensus
-forms, the ADR is updated to Accepted with a Decision section filled in.
-
 Each ADR includes YAML frontmatter with structured metadata:
 
 - **title** -- The ADR title (required).
@@ -77,8 +66,7 @@ runs in CI to validate statuses, number uniqueness, and frontmatter correctness
 
 - Problem documents in `docs/problems/` remain the place for open-ended
   exploration. ADRs are for when a specific decision point has been identified.
-- Contributors can propose ADRs in the Undecided state to start structured
-  discussion around a specific choice.
+- Contributors propose ADRs via pull requests for discussion before merging.
 - The linting ensures ADRs follow the expected format, catching mistakes early.
 - We inherit a proven format from the broader konflux-ci organization, making it
   familiar to contributors who work across repos.