Fix missing gcp-vertex.env that blocks all dependabot-risk-rater runs #18

What happened

PR #17 improved the dependabot-risk-rater sandbox security by removing GH_TOKEN and DNS access (diff). After merge, a harness run attempted to execute the agent but the dispatch / Harness run (dependabot-risk-rater) job failed with:

Error: validating files: host_files[0].src: stat .../rhdh-plugins/.fullsend/common/env/gcp-vertex.env: no such file or directory

The harness config at .fullsend/rhdh/harness/dependabot-risk-rater.yaml references common/env/gcp-vertex.env as the first host_files entry (not marked optional: true). The .fullsend/common/ directory does not exist in the repo. The fullsend platform E2E tests state the scaffold does not ship this file — it is expected to be provided per-harness by the repo author, with ${VAR} placeholders expanded from runner environment variables set by the setup-gcp action.

What could go better

This is a pre-existing configuration gap that predates PR #17 — the gcp-vertex.env reference was already in the harness config before this PR's changes. However, the gap means: (1) no dependabot-risk-rater harness run can succeed until this is fixed — the validation is deterministic and fails on every attempt; (2) PR #17's sandbox security changes cannot be validated end-to-end; (3) the PR was merged without testing the full harness flow, and without review that could have caught this pre-existing blocker.

Confidence: High — the error is deterministic, the file's absence is verified in the repo, and the platform E2E tests confirm this file is not scaffold-provided. The repo uses GCP Vertex AI for inference (per .fullsend/config.yaml), so this env file is needed for the agent to reach the model provider.

Proposed change

Create .fullsend/common/env/gcp-vertex.env with GCP Vertex AI configuration variables (e.g., GCP_PROJECT, GCP_REGION) using ${VAR} placeholders that the harness expands from the runner environment set by setup-gcp. Reference the existing providers/vertex-ai.yaml and profiles/fullsend-vertex-ai.yaml from the fullsend scaffold for the expected variable names.

Alternatively, if GCP Vertex AI provisioning is not yet complete for this repo (consistent with open provisioning issues #5–#8), mark the entry as optional: true in .fullsend/rhdh/harness/dependabot-risk-rater.yaml so the harness run can proceed past validation. Note that the other GCP-related entry (GCP_OIDC_TOKEN_FILE) is already marked optional: true in the same config.

Validation criteria

After the fix, trigger a dependabot-risk-rater harness run on a dependency update PR. The run should pass the host file validation step and reach the agent execution step. The harness run log should not contain the gcp-vertex.env file-not-found error. Verify on at least one successful harness run.

Generated by retro agent from #17