Skip to content

fix(#621)!: tighten head_sha schema to require 40 or 64 hex chars - #622

Merged
rh-hemartin merged 2 commits into
mainfrom
agent/621-tighten-head-sha-schema
Aug 3, 2026
Merged

fix(#621)!: tighten head_sha schema to require 40 or 64 hex chars#622
rh-hemartin merged 2 commits into
mainfrom
agent/621-tighten-head-sha-schema

Conversation

@fullsend-ai-coder

Copy link
Copy Markdown
Contributor

Summary

  • Replace head_sha validation in review-result.schema.json from {"minLength": 7} to {"pattern": "^[0-9a-fA-F]{40}$|^[0-9a-fA-F]{64}$"}, aligning the schema with the CLI's hexSHARe regex in internal/cli/postreview.go
  • Update 8 test fixtures in validate-output-schema-test.sh and 23 fixtures in post-review-test.sh that used short SHAs ("abc1234" / "abc123") to use valid 40-character hex strings
  • Add two negative test cases: short SHA (7-char) rejected, non-hex SHA (40-char with invalid chars) rejected

Context

The schema and CLI enforced different constraints on the same head_sha field. A code agent produced "0000000" which passed schema validation but failed at the CLI step (fullsend post-review), triggering an avoidable fix iteration on PR fullsend-ai/fullsend#5654. This change catches invalid SHAs at schema validation time, preventing that class of failures.

Breaking change

The head_sha field now requires exactly 40 or 64 hex characters. Previously any string of 7+ characters was accepted by the schema. The CLI already enforced this constraint at runtime, so no working end-to-end workflows are affected.

Testing

  • bash scripts/validate-output-schema-test.sh — all tests pass (including 2 new negative cases)
  • bash scripts/post-review-test.sh — all tests pass with updated fixtures

Closes #621

Post-script verification

  • Branch is not main/master (agent/621-tighten-head-sha-schema)
  • Secret scan passed (gitleaks — 4ea342abf067696961d0df7b922e0498e332a371..HEAD)
  • PR body secret scan passed (gitleaks — no-git)

The head_sha field in review-result.schema.json used a loose
minLength: 7 constraint while the CLI enforces a strict regex
requiring 40 or 64 hex characters. This divergence allowed
schema-valid values that failed at runtime, causing unnecessary
agent fix iterations (e.g. fullsend#5654).

Replace {"minLength": 7} with the CLI's regex pattern
{"pattern": "^[0-9a-fA-F]{40}$|^[0-9a-fA-F]{64}$"} to catch
invalid SHAs at schema validation time.

Update test fixtures in validate-output-schema-test.sh (8 fixtures
using 7-char "abc1234") and post-review-test.sh (23 fixtures using
6-char "abc123") to use valid 40-char hex strings. Add two negative
test cases: short SHA rejected, non-hex SHA rejected.

BREAKING CHANGE: The head_sha field now requires exactly 40 or 64
hex characters. Previously any string of 7+ characters was accepted
by the schema. The CLI already enforced this constraint at runtime,
so no working end-to-end workflows are affected.

Closes #621
@fullsend-ai-coder
fullsend-ai-coder Bot requested a review from a team as a code owner August 3, 2026 12:15
@fullsend-ai-coder fullsend-ai-coder Bot added the ready-for-review Triggers review agent dispatch label Aug 3, 2026
@fullsend-ai-review

fullsend-ai-review Bot commented Aug 3, 2026

Copy link
Copy Markdown

🤖 Finished Review · ✅ Success · Started 12:16 PM UTC · Completed 12:30 PM UTC
Commit: 1f6f08e · View workflow run →

@fullsend-ai-review

fullsend-ai-review Bot commented Aug 3, 2026

Copy link
Copy Markdown

Review

Findings

Medium

Low

  • [breaking-change] schemas/review-result.schema.json:16 — The head_sha field validation is tightened from minLength: 7 to a regex requiring exactly 40 (SHA-1) or 64 (SHA-256) hex characters. This is an intentional breaking change (properly disclosed with ! in the commit subject) that fixes a real bug where the overly permissive old schema allowed invalid values (e.g., "0000000") that failed downstream at the CLI step.

Labels: PR modifies review agent schema validation and agent definition.

Previous run

Review

Findings

Medium

  • [breaking-change] schemas/review-result.schema.json:16 — The head_sha field constraint is tightened from minLength: 7 to a pattern requiring exactly 40 or 64 hex characters. This is an intentional breaking change (properly disclosed with ! in the commit subject). The CLI reportedly already enforced this at runtime, but that claim references code in a separate repository and cannot be independently verified here. External tooling or tests generating review-result.json with short SHAs will now fail schema validation.
    Remediation: Verify that all consumers of this schema in external repositories use full 40 or 64 character hex SHAs.

  • [stale-doc] agents/review.md:251 — Documentation describes head_sha as "Commit SHA (min 7 chars)" but the schema now requires exactly 40 or 64 hexadecimal characters.
    Remediation: Update the description from "Commit SHA (min 7 chars)" to "Commit SHA (40 or 64 hex chars)" to match the new pattern validation.

  • [protected-path] scripts/ — PR modifies files under protected paths: scripts/post-review-test.sh, scripts/validate-output-schema-test.sh. The PR links to issue Tighten head_sha validation in review-result.schema.json to match CLI requirements #621 and explains the rationale. Human approval is always required for protected-path changes.

fullsend-ai-review[bot]

This comment was marked as outdated.

@fullsend-ai-review fullsend-ai-review Bot added the requires-manual-review Review requires human judgment label Aug 3, 2026
@rh-hemartin

Copy link
Copy Markdown
Member

/fs-fix

@fullsend-ai-coder

fullsend-ai-coder Bot commented Aug 3, 2026

Copy link
Copy Markdown
Contributor Author

🤖 Finished Fix · ✅ Success · Started 1:15 PM UTC · Completed 1:20 PM UTC
Commit: 1f6f08e · View workflow run →

Update the head_sha field description in agents/review.md from
"Commit SHA (min 7 chars)" to "Commit SHA (40 or 64 hex chars)" to
match the new pattern validation in review-result.schema.json.

Addresses review feedback on #622
@fullsend-ai-coder

Copy link
Copy Markdown
Contributor Author

🔧 Fix agent — iteration 1 (human-triggered)

Fixed 1 of 3 review findings. Updated stale documentation in agents/review.md to reflect the tightened head_sha schema constraint. Disagreed with 2 informational findings (out-of-scope external verification and protected-path note).

Fixed (1):

  1. stale-doc: head_sha description in agents/review.md says 'min 7 chars' (agents/review.md): Updated head_sha field description from 'Commit SHA (min 7 chars)' to 'Commit SHA (40 or 64 hex chars)' to match the tightened pattern in review-result.schema.json

Disagreed (2):

  1. breaking-change: verify all consumers of review-result.schema.json in external repositories: Out of scope for this PR. The breaking change is intentional, properly disclosed with '!' in the commit subject, and the CLI already enforced 40/64 hex char SHAs at runtime. No working end-to-end workflows are affected.
  2. protected-path: PR modifies files under scripts/: Informational note acknowledged. The PR already carries the 'requires-manual-review' label and protected-path changes require human approval by design. No code change needed.

Tests: passed

Next steps:

  • /fs-review — request a re-review of the changes
  • /fs-fix <your instruction> — run another fix pass with specific guidance
  • Push commits directly — review re-runs automatically on push
    Updated by fullsend fix agent

@fullsend-ai-review

fullsend-ai-review Bot commented Aug 3, 2026

Copy link
Copy Markdown

🤖 Finished Review · ✅ Success · Started 1:21 PM UTC · Completed 1:33 PM UTC
Commit: 456ae50 · View workflow run →

@fullsend-ai-review fullsend-ai-review Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

See the review comment for full details.

Comment thread schemas/review-result.schema.json
@rh-hemartin
rh-hemartin added this pull request to the merge queue Aug 3, 2026
Merged via the queue into main with commit 747566d Aug 3, 2026
20 checks passed
@rh-hemartin
rh-hemartin deleted the agent/621-tighten-head-sha-schema branch August 3, 2026 13:38
@fullsend-ai-retro

fullsend-ai-retro Bot commented Aug 3, 2026

Copy link
Copy Markdown

🤖 Finished Retro · ✅ Success · Started 1:41 PM UTC · Completed 1:55 PM UTC
Commit: 456ae50 · View workflow run →

@fullsend-ai-retro

Copy link
Copy Markdown

Retro: PR #622 — Tighten head_sha schema to require 40 or 64 hex chars

Timeline

Time (UTC) Actor Event
Jul 28 11:48 retro agent Filed issue as fullsend#5669 (wrong repo — used fullsend scaffold paths instead of agents-repo paths)
Jul 28 11:50–11:53 triage agent Ran on fullsend#5669, labeled bug + ready-to-code
Jul 28 11:55–12:02 code agent Produced fullsend PR #5674 — wrong repo, modifying scaffold copies
Aug 1 09:05 prioritize agent RICE score 1.8
Aug 3 11:59 rh-hemartin Closed PR #5674 ("does not belong here"), transferred issue to agents#621, ran /fs-triage
Aug 3 12:00–12:06 triage agent Re-triaged in agents repo, corrected file paths, expanded scope to include post-review-test.sh, proposed specific negative test cases
Aug 3 12:07–12:15 code agent Produced PR #622 — correct repo, 4 files changed
Aug 3 12:15–12:30 review agent (run 30812842367) First review: 3 findings — breaking-change (medium), stale-doc (medium, agents/review.md still said "min 7 chars"), protected-path (medium). Verdict: comment
Aug 3 13:14 rh-hemartin /fs-fix
Aug 3 13:15–13:20 fix agent (run 30817044351) Updated agents/review.md description, disagreed with breaking-change and protected-path
Aug 3 13:20–13:33 review agent (run 30817522080) Re-review: downgraded breaking-change to low, acknowledged protected-path label already present. Verdict: comment
Aug 3 13:36 rh-hemartin Approved
Aug 3 13:38 merge PR merged, issue closed

What went well

  • Triage quality (Aug 3): The re-triage in the correct repo was excellent — it corrected all file paths, expanded scope to include scripts/post-review-test.sh (with ~20 fixtures using invalid SHAs), and proposed specific negative test cases that the code agent directly implemented.
  • Code agent output: The schema change, test fixture updates (31 fixtures across 2 files), and 2 new negative test cases were all correct on the first attempt.
  • Review agent caught a real miss: The stale-doc finding (agents/review.md still described head_sha as "min 7 chars") was a genuine documentation inconsistency that the code agent should have addressed.
  • Fix agent was efficient: Addressed the valid finding, correctly disagreed with the informational ones.
  • Re-review calibration: Appropriately downgraded the breaking-change severity after verifying the ! marker and confirming the change fixes a real bug.
  • Time to merge (in correct repo): ~1.5 hours from PR creation to merge.

Evidence for existing open issues

All significant improvement opportunities from this workflow are already tracked:

Assessment

Once the issue was in the correct repo, the pipeline worked well. The primary quality gap — the code agent missing a documentation update — required one fix iteration but was caught by the review agent. The 6-day delay from cross-repo misfiling was the most significant waste, and is already tracked in #624. No new proposals are warranted.

ggallen pushed a commit that referenced this pull request Aug 19, 2026
Update the head_sha field description in agents/review.md from
"Commit SHA (min 7 chars)" to "Commit SHA (40 or 64 hex chars)" to
match the new pattern validation in review-result.schema.json.

Addresses review feedback on #622
ggallen pushed a commit to ggallen/agents that referenced this pull request Aug 19, 2026
Update the head_sha field description in agents/review.md from
"Commit SHA (min 7 chars)" to "Commit SHA (40 or 64 hex chars)" to
match the new pattern validation in review-result.schema.json.

Addresses review feedback on fullsend-ai#622
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

ready-for-review Triggers review agent dispatch requires-manual-review Review requires human judgment review-agent

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Tighten head_sha validation in review-result.schema.json to match CLI requirements

1 participant