Skip to content

chore: migrate remaining runner_env keys to env.runner #631

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
ralphbean merged 2 commits into from
Aug 3, 2026
Merged

chore: migrate remaining runner_env keys to env.runner #631

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
02dc8bb
chore: migrate remaining runner_env keys to env.runner
ralphbean Aug 3, 2026
4f665cc
Merge branch 'main' into chore/env-runner-syntax
ralphbean Aug 3, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion docs/code.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -41,7 +41,7 @@ See [Customizing with AGENTS.md](https://fullsend.sh/docs/guides/user/customizin

| Variable | Description | Default | Valid values |
|----------|-------------|---------|--------------|
| `CODE_ALLOWED_TARGET_BRANCHES` | Restricts which branches the code agent can target when pushing. The post-code script validates the agent's chosen target branch against this variable before pushing. Set via `runner_env` in `harness/code.yaml` (never injected into the sandbox). | Repo default branch (auto-detected via GitHub API; falls back to `main`) | Comma-separated branch names (e.g. `main,develop`) or `*` for any branch |
| `CODE_ALLOWED_TARGET_BRANCHES` | Restricts which branches the code agent can target when pushing. The post-code script validates the agent's chosen target branch against this variable before pushing. Set via `env.runner` in `harness/code.yaml` (never injected into the sandbox). | Repo default branch (auto-detected via GitHub API; falls back to `main`) | Comma-separated branch names (e.g. `main,develop`) or `*` for any branch |

## How the agent works

Expand Down
2 changes: 1 addition & 1 deletion env/code.env
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,7 +5,7 @@ export GITHUB_ISSUE_URL=${GITHUB_ISSUE_URL}
# (contents:read, issues:read, pull_requests:read). Set by
# setup-agent-env.sh from CODE_GH_TOKEN. This token CANNOT push code
# or create PRs — token scoping is the primary enforcement mechanism.
# The separate write-enabled PUSH_TOKEN (runner_env) never enters the sandbox.
# The separate write-enabled PUSH_TOKEN (env.runner) never enters the sandbox.
export GH_TOKEN=${GH_TOKEN}

# Git identity — uses the GitHub App bot user's noreply email so GitHub
Expand Down
2 changes: 1 addition & 1 deletion eval/scripts/run-fullsend.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -153,7 +153,7 @@ install -m 0600 /dev/null "$ENV_FILE"
emit_env "PUSH_TOKEN" "${GH_TOKEN}"
emit_env "REVIEW_TOKEN" "${GH_TOKEN}"

# Code/fix harness runner_env refs — mint normally sets these; eval skips mint.
# Code/fix harness env.runner refs — mint normally sets these; eval skips mint.
# Only override GITHUB_WORKSPACE for agents whose post-scripts expand
# REPO_DIR=${GITHUB_WORKSPACE}/target-repo (triage reads config.yaml from
# the real Actions workspace and must not be redirected to the temp clone).
Expand Down
16 changes: 9 additions & 7 deletions harness/code.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -48,17 +48,19 @@ validation_loop:

# Environment variables available to pre/post scripts on the runner.
# These are expanded from the runner environment and NEVER enter the sandbox.
runner_env:
CODE_ALLOWED_TARGET_BRANCHES: "${CODE_ALLOWED_TARGET_BRANCHES}"
env:
Comment thread
ralphbean marked this conversation as resolved.
Resolved

@fullsend-ai-review fullsend-ai-review Bot Aug 3, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[low] breaking-schema-change

Migration from runner_env to env.runner changes the harness YAML schema contract. The downstream consumer (fullsend-ai/fullsend) already supports this schema since fix.yaml, triage.yaml, prioritize.yaml, scribe.yaml, and review.yaml all use env.runner. Two separate runner_env blocks are migrated: one at top level (line 51) and one under forge.github (line 61).

runner:
CODE_ALLOWED_TARGET_BRANCHES: "${CODE_ALLOWED_TARGET_BRANCHES}"
Comment thread
qodo-code-review[bot] marked this conversation as resolved.
Resolved
Comment thread
ralphbean marked this conversation as resolved.
Resolved

timeout_minutes: 35

forge:
github:
pre_script: scripts/pre-code.sh
post_script: scripts/post-code.sh
runner_env:
PUSH_TOKEN: "${PUSH_TOKEN}"
PUSH_TOKEN_SOURCE: "${PUSH_TOKEN_SOURCE}"
REPO_FULL_NAME: "${REPO_FULL_NAME}"
ISSUE_NUMBER: "${ISSUE_NUMBER}"
env:
runner:
PUSH_TOKEN: "${PUSH_TOKEN}"
PUSH_TOKEN_SOURCE: "${PUSH_TOKEN_SOURCE}"
REPO_FULL_NAME: "${REPO_FULL_NAME}"
ISSUE_NUMBER: "${ISSUE_NUMBER}"
9 changes: 5 additions & 4 deletions harness/retro.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -41,7 +41,8 @@ forge:
github:
pre_script: scripts/pre-retro.sh
post_script: scripts/post-retro.sh
runner_env:
ORIGINATING_URL: "${ORIGINATING_URL}"
REPO_FULL_NAME: "${REPO_FULL_NAME}"
GH_TOKEN: "${GH_TOKEN}"
env:

@fullsend-ai-review fullsend-ai-review Bot Aug 3, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[low] breaking-schema-change

Migration from runner_env to env.runner changes the harness YAML schema contract under forge.github. The downstream consumer already supports this schema since five other harness files use env.runner.

runner:
ORIGINATING_URL: "${ORIGINATING_URL}"
REPO_FULL_NAME: "${REPO_FULL_NAME}"
GH_TOKEN: "${GH_TOKEN}"
Loading