fix(dispatch): address review feedback on workflow_call dispatch

- Per-org stage jobs: explicit OIDC permissions; kill-switch ternary fix
- Role mapping: code|fix → coder; prioritize workflow_call secrets
- Per-repo reusable-dispatch: prioritize job via .fullsend/prioritize.yml
- finding-agent-runs skill: dispatch.yml instead of removed thin workflows
- reusable-fix: fail closed when gh pr view fails (bot eligibility)
- pre-code-test: restore line-by-line extra_env parsing
- e2e: capture issueCreatedAt before issue creation

Signed-off-by: Barak Korren <bkorren@redhat.com>
Co-authored-by: Cursor <cursoragent@cursor.com>
Signed-off-by: Barak Korren <bkorren@redhat.com>
Co-authored-by: Cursor <cursoragent@cursor.com>
Signed-off-by: Barak Korren <bkorren@redhat.com>
Co-authored-by: Cursor <cursoragent@cursor.com>
Signed-off-by: Barak Korren <bkorren@redhat.com>
Co-authored-by: Cursor <cursoragent@cursor.com>
Signed-off-by: Barak Korren <bkorren@redhat.com>
Co-authored-by: Cursor <cursoragent@cursor.com>

Author: ifireball

.github/workflows/reusable-code.yml

@@ -127,6 +127,7 @@ jobs:
           ISSUE_NUMBER: ${{ fromJSON(inputs.event_payload).issue.number }}
           REPO_FULL_NAME: ${{ inputs.source_repo }}
           GITHUB_ISSUE_URL: ${{ fromJSON(inputs.event_payload).issue.html_url }}
+          COMMENT_BODY: ${{ fromJSON(inputs.event_payload).comment.body }}
         run: bash scripts/pre-code.sh
 
       - name: Setup GCP and prepare credentials

.github/workflows/reusable-dispatch.yml

@@ -49,7 +49,7 @@ jobs:
       contents: read
       pull-requests: read
     outputs:
-      stage: ${{ steps.role-check.outputs.skipped == 'true' && '' || steps.route.outputs.stage }}
+      stage: ${{ steps.role-check.outputs.skipped != 'true' && steps.route.outputs.stage || '' }}
       trigger_source: ${{ steps.route.outputs.trigger_source }}
       event_payload: ${{ steps.payload.outputs.event_payload }}
     steps:
@@ -413,3 +413,19 @@ jobs:
       FULLSEND_GCP_WIF_PROVIDER: ${{ secrets.FULLSEND_GCP_WIF_PROVIDER }}
 
       FULLSEND_GCP_PROJECT_ID: ${{ secrets.FULLSEND_GCP_PROJECT_ID }}
+
+  prioritize:
+    name: Prioritize
+    needs: route
+    if: needs.route.outputs.stage == 'prioritize'
+    uses: ./.fullsend/.github/workflows/prioritize.yml
+    permissions:
+      contents: read
+      id-token: write
+    with:
+      event_type: ${{ github.event_name }}
+      source_repo: ${{ github.repository }}
+      event_payload: ${{ needs.route.outputs.event_payload }}
+    secrets:
+      FULLSEND_GCP_WIF_PROVIDER: ${{ secrets.FULLSEND_GCP_WIF_PROVIDER }}
+      FULLSEND_GCP_PROJECT_ID: ${{ secrets.FULLSEND_GCP_PROJECT_ID }}

.github/workflows/reusable-fix.yml

@@ -259,8 +259,8 @@ jobs:
         run: |
           if [[ "${TRIGGER_SOURCE}" =~ \[bot\]$ ]]; then
             PR_INFO=$(gh pr view "${PR_NUM}" --repo "${SOURCE_REPO}" \
-              --json labels,author --jq '{labels: [.labels[].name], author: .author.login}' 2>/dev/null \
-              || echo '{"labels":[],"author":""}')
+              --json labels,author --jq '{labels: [.labels[].name], author: .author.login}') \
+              || { echo "::error::Failed to fetch PR info for #${PR_NUM}"; exit 1; }
 
             HAS_NO_FIX=$(echo "${PR_INFO}" | jq -r '.labels | any(. == "fullsend-no-fix")')
             if [[ "${HAS_NO_FIX}" == "true" ]]; then

.pre-commit-config.yaml

@@ -70,6 +70,8 @@ repos:
           - SC2016
           - -ignore
           - 'could not read reusable workflow file for "\./\.github/workflows/prioritize\.yml"'
+          - -ignore
+          - 'could not read reusable workflow file for "\./\.fullsend/\.github/workflows/prioritize\.yml"'
 
   - repo: local
     hooks:

e2e/admin/admin_test.go

@@ -250,6 +250,11 @@ func runTriageDispatchSmokeTest(t *testing.T, env *e2eEnv) {
 	t.Helper()
 	ctx := context.Background()
 
+	// Capture a lower-bound timestamp *before* creating the issue.
+	// The shim/dispatch workflows can start very quickly, and we only want to
+	// filter out runs from earlier test phases.
+	issueCreatedAt := time.Now()
+
 	// File a test issue to trigger the shim workflow.
 	issueTitle := fmt.Sprintf("e2e-triage-test-%s", env.runID)
 	issueBody := `## Bug Report
@@ -291,15 +296,14 @@ Files over 64KB save fine if they contain only ASCII characters.`
 		}
 	})
 
-	// Wait for dispatch.yml to run in .fullsend (shim → dispatch → reusable-triage).
-	// The shim fires on issues:opened and runs the triage stage synchronously.
-	// Filter by CreatedAt to avoid false positives from previous runs.
-	issueCreatedAt := time.Now()
-	t.Log("Waiting for dispatch workflow to run...")
-	var dispatchRun *forge.WorkflowRun
+	// Wait for the enrolled-repo shim (fullsend.yaml). Cross-repo workflow_call
+	// runs appear on the caller repo, not as separate dispatch.yml runs in .fullsend.
+	// Chain: fullsend.yaml → .fullsend/dispatch.yml → reusable-triage (sync).
+	t.Log("Waiting for fullsend shim workflow to run...")
+	var shimRun *forge.WorkflowRun
 	for attempt := 0; attempt < 12; attempt++ {
 		time.Sleep(5 * time.Second)
-		runs, listErr := env.client.ListWorkflowRuns(ctx, env.org, forge.ConfigRepoName, "dispatch.yml")
+		runs, listErr := env.client.ListWorkflowRuns(ctx, env.org, testRepo, "fullsend.yaml")
 		if listErr != nil {
 			t.Logf("Attempt %d: error listing workflow runs: %v", attempt+1, listErr)
 			continue
@@ -316,24 +320,24 @@ Files over 64KB save fine if they contain only ASCII characters.`
 			}
 			t.Logf("Attempt %d: found run %d (status: %s, conclusion: %s, created: %s)", attempt+1, run.ID, run.Status, run.Conclusion, run.CreatedAt)
 			r := run // avoid loop variable capture
-			dispatchRun = &r
+			shimRun = &r
 			break
 		}
-		if dispatchRun != nil {
+		if shimRun != nil {
 			break
 		}
-		t.Logf("Attempt %d: no dispatch workflow runs found yet", attempt+1)
+		t.Logf("Attempt %d: no fullsend shim workflow runs found yet", attempt+1)
 	}
-	require.NotNil(t, dispatchRun, "dispatch workflow should have run in .fullsend repo")
+	require.NotNil(t, shimRun, "fullsend shim workflow should have run in enrolled repo")
 
 	// Wait for the workflow run to complete (up to 12 minutes: 10-minute agent
 	// timeout + sandbox setup overhead).
-	t.Logf("Waiting for dispatch workflow run %d to complete...", dispatchRun.ID)
+	t.Logf("Waiting for fullsend shim workflow run %d to complete...", shimRun.ID)
 	var finalRun *forge.WorkflowRun
 	deadline := time.Now().Add(12 * time.Minute)
 	for time.Now().Before(deadline) {
 		time.Sleep(15 * time.Second)
-		run, getErr := env.client.GetWorkflowRun(ctx, env.org, forge.ConfigRepoName, dispatchRun.ID)
+		run, getErr := env.client.GetWorkflowRun(ctx, env.org, testRepo, shimRun.ID)
 		if getErr != nil {
 			t.Logf("Error polling workflow run: %v", getErr)
 			continue
@@ -344,34 +348,34 @@ Files over 64KB save fine if they contain only ASCII characters.`
 			break
 		}
 	}
-	require.NotNil(t, finalRun, "dispatch workflow run should have completed within deadline")
+	require.NotNil(t, finalRun, "fullsend shim workflow run should have completed within deadline")
 
 	// If the run failed, save logs and artifacts for debugging.
 	if finalRun.Conclusion != "success" {
-		runURL := fmt.Sprintf("https://github.com/%s/%s/actions/runs/%d", env.org, forge.ConfigRepoName, finalRun.ID)
-		fmt.Fprintf(os.Stderr, "::notice::Dispatch workflow run %d failed (conclusion: %s). Downloading debug artifacts. Run URL: %s\n", finalRun.ID, finalRun.Conclusion, runURL)
+		runURL := fmt.Sprintf("https://github.com/%s/%s/actions/runs/%d", env.org, testRepo, finalRun.ID)
+		fmt.Fprintf(os.Stderr, "::notice::Fullsend shim run %d failed (conclusion: %s). Downloading debug artifacts. Run URL: %s\n", finalRun.ID, finalRun.Conclusion, runURL)
 
-		debugDir := filepath.Join(env.screenshotDir, fmt.Sprintf("dispatch-run-%d", finalRun.ID))
+		debugDir := filepath.Join(env.screenshotDir, fmt.Sprintf("fullsend-run-%d", finalRun.ID))
 		_ = os.MkdirAll(debugDir, 0o755)
 
 		// Save workflow logs.
-		logs, logErr := env.client.GetWorkflowRunLogs(ctx, env.org, forge.ConfigRepoName, finalRun.ID)
+		logs, logErr := env.client.GetWorkflowRunLogs(ctx, env.org, testRepo, finalRun.ID)
 		if logErr != nil {
 			t.Logf("Could not fetch run logs: %v", logErr)
 		} else {
 			logPath := filepath.Join(debugDir, "workflow-logs.txt")
 			if writeErr := os.WriteFile(logPath, []byte(logs), 0o644); writeErr != nil {
 				t.Logf("Could not write logs to %s: %v", logPath, writeErr)
 			} else {
-				fmt.Fprintf(os.Stderr, "::notice file=%s::Dispatch run %d workflow logs saved\n", logPath, finalRun.ID)
+				fmt.Fprintf(os.Stderr, "::notice file=%s::Fullsend shim run %d workflow logs saved\n", logPath, finalRun.ID)
 			}
 			t.Logf("Workflow run logs:\n%s", logs)
 		}
 
 		// Download run artifacts (transcripts, etc).
-		downloadRunArtifacts(ctx, env.token, env.org, forge.ConfigRepoName, finalRun.ID, debugDir, t)
+		downloadRunArtifacts(ctx, env.token, env.org, testRepo, finalRun.ID, debugDir, t)
 
-		t.Fatalf("Dispatch workflow run %d concluded with %q, expected success. Debug artifacts saved to %s", finalRun.ID, finalRun.Conclusion, debugDir)
+		t.Fatalf("Fullsend shim workflow run %d concluded with %q, expected success. Debug artifacts saved to %s", finalRun.ID, finalRun.Conclusion, debugDir)
 	}
 
 	// Verify the triage agent posted a comment on the issue.

internal/scaffold/fullsend-repo/.github/workflows/dispatch.yml

@@ -25,13 +25,14 @@ jobs:
       contents: read
       pull-requests: read
     outputs:
-      stage: ${{ steps.role-check.outputs.skipped == 'true' && '' || steps.route.outputs.stage }}
+      stage: ${{ steps.role-check.outputs.skipped != 'true' && steps.route.outputs.stage || '' }}
       trigger_source: ${{ steps.route.outputs.trigger_source }}
       event_payload: ${{ steps.payload.outputs.event_payload }}
     steps:
       - name: Checkout config repository
         uses: actions/checkout@v6
         with:
+          repository: ${{ job.workflow_repository }}
           persist-credentials: false
           sparse-checkout: config.yaml
           sparse-checkout-cone-mode: false
@@ -231,7 +232,7 @@ jobs:
           set -euo pipefail
           STAGE_ROLE="$STAGE"
           case "$STAGE" in
-            code) STAGE_ROLE="coder" ;;
+            code|fix) STAGE_ROLE="coder" ;;
             retro|prioritize) STAGE_ROLE="fullsend" ;;
           esac
 
@@ -292,6 +293,9 @@ jobs:
     name: Triage
     needs: route
     if: needs.route.outputs.stage == 'triage'
+    permissions:
+      contents: read
+      id-token: write
     uses: fullsend-ai/fullsend/.github/workflows/reusable-triage.yml@v0
     with:
       event_type: ${{ github.event_name }}
@@ -308,6 +312,9 @@ jobs:
     name: Code
     needs: route
     if: needs.route.outputs.stage == 'code'
+    permissions:
+      contents: read
+      id-token: write
     uses: fullsend-ai/fullsend/.github/workflows/reusable-code.yml@v0
     with:
       event_type: ${{ github.event_name }}
@@ -324,6 +331,9 @@ jobs:
     name: Review
     needs: route
     if: needs.route.outputs.stage == 'review'
+    permissions:
+      contents: read
+      id-token: write
     uses: fullsend-ai/fullsend/.github/workflows/reusable-review.yml@v0
     with:
       event_type: ${{ github.event_name }}
@@ -340,6 +350,9 @@ jobs:
     name: Fix
     needs: route
     if: needs.route.outputs.stage == 'fix'
+    permissions:
+      contents: read
+      id-token: write
     uses: fullsend-ai/fullsend/.github/workflows/reusable-fix.yml@v0
     with:
       event_type: ${{ github.event_name }}
@@ -357,6 +370,9 @@ jobs:
     name: Retro
     needs: route
     if: needs.route.outputs.stage == 'retro'
+    permissions:
+      contents: read
+      id-token: write
     uses: fullsend-ai/fullsend/.github/workflows/reusable-retro.yml@v0
     with:
       event_type: ${{ github.event_name }}
@@ -374,6 +390,12 @@ jobs:
     needs: route
     if: needs.route.outputs.stage == 'prioritize'
     uses: ./.github/workflows/prioritize.yml
+    permissions:
+      contents: read
+      id-token: write
+    secrets:
+      FULLSEND_GCP_WIF_PROVIDER: ${{ secrets.FULLSEND_GCP_WIF_PROVIDER }}
+      FULLSEND_GCP_PROJECT_ID: ${{ secrets.FULLSEND_GCP_PROJECT_ID }}
     with:
       event_type: ${{ github.event_name }}
       source_repo: ${{ github.repository }}

internal/scaffold/fullsend-repo/.github/workflows/prioritize.yml

@@ -12,6 +12,11 @@ on:
       event_payload:
         required: true
         type: string
+    secrets:
+      FULLSEND_GCP_WIF_PROVIDER:
+        required: true
+      FULLSEND_GCP_PROJECT_ID:
+        required: true
   workflow_dispatch:
     inputs:
       event_type:

internal/scaffold/fullsend-repo/agents/triage.md

@@ -76,6 +76,17 @@ gh pr view BLOCKING_URL --json state,title,body,comments,labels,mergedAt
 
 Use `gh issue view` for `/issues/` URLs and `gh pr view` for `/pull/` URLs. Review the blocker's state, recent comments, and labels to determine whether the dependency has been resolved, is making progress, or remains stalled. If the blocker has been closed or merged, the block may be resolved — proceed with a fresh assessment.
 
+### 2d. Review prior triage analysis
+
+Check whether this issue has already been triaged. Look through the comments you fetched in Step 1 for a prior triage comment — it will contain `<!-- fullsend:triage-agent -->` in its body, or be posted by a user whose login ends in `-triage[bot]`.
+
+If a prior triage comment exists, **accumulate — do not replace:**
+
+- **Preserve all previously identified problems.** Treat every cause documented in the prior analysis as an established finding. Do not silently drop any of them. If you believe a previously identified cause is no longer valid (e.g., already fixed, confirmed misdiagnosis), document this explicitly in `reasoning` — a cause removed without explanation is a regression in analysis quality.
+- **Incorporate human-identified problems.** When an issue author or contributor adds a comment that says "the real issue is X", "you also missed Y", or otherwise points to a problem not in the prior analysis, treat it with the same evidentiary weight as a clear error message. If you cannot independently verify the claim, include it as a hypothesis — do not omit it.
+- **Your new analysis must be a superset** of the prior analysis. Identified problems accumulate across triage runs; the count of documented problems can only go up, not down (unless a cause is explicitly refuted with reasoning).
+- **Re-triaging is about incorporating new information**, not restarting from scratch. If a human comment triggered this re-run, focus your analysis on what that comment changes or adds. Then confirm all previously documented problems are still represented.
+
 ## Step 3: Assess information sufficiency
 
 Use this phased approach to evaluate the issue:

internal/scaffold/fullsend-repo/scripts/pre-code-test.sh

@@ -86,11 +86,11 @@ run_test() {
     GH_TOKEN="fake-token"
   )
 
-  # Add extra env vars if provided.
+  # Add extra env vars if provided (read line-by-line to support values with spaces).
   if [[ -n "${extra_env}" ]]; then
-    for kv in ${extra_env}; do
-      env_cmd+=("${kv}")
-    done
+    while IFS= read -r kv; do
+      [[ -n "${kv}" ]] && env_cmd+=("${kv}")
+    done <<< "${extra_env}"
   fi
 
   local exit_code=0
@@ -139,9 +139,9 @@ run_test_stdout() {
   )
 
   if [[ -n "${extra_env}" ]]; then
-    for kv in ${extra_env}; do
-      env_cmd+=("${kv}")
-    done
+    while IFS= read -r kv; do
+      [[ -n "${kv}" ]] && env_cmd+=("${kv}")
+    done <<< "${extra_env}"
   fi
 
   local exit_code=0
@@ -205,6 +205,13 @@ run_test_stdout "force-override-skips-check" \
   0 \
   "CODE_FORCE=true"
 
+# COMMENT_BODY contains --force → should also skip check.
+run_test_stdout "force-override-comment-body" \
+  "99${TAB}human-dev${TAB}https://github.com/test-org/test-repo/pull/99" \
+  "Force override" \
+  0 \
+  "COMMENT_BODY=/fs-code --force"
+
 # No GH_TOKEN → skips check entirely, exits 0.
 run_test_stdout "no-gh-token-skips-check" \
   "" \

internal/scaffold/fullsend-repo/scripts/pre-code.sh

@@ -60,8 +60,8 @@ if [[ -z "${GH_TOKEN:-}" ]]; then
   exit 0
 fi
 
-# Allow override via CODE_FORCE (set when /fs-code --force is used).
-if [[ "${CODE_FORCE:-}" == "true" ]]; then
+# Allow override when --force is in the trigger comment or CODE_FORCE is set.
+if [[ "${CODE_FORCE:-}" == "true" ]] || [[ "${COMMENT_BODY:-}" == *--force* ]]; then
   echo "CODE_FORCE=true — skipping existing-PR check"
   exit 0
 fi