chore: update fullsend per-repo installation

[ggallen]

The default branch (main) has branch protection rules that prevent direct pushes.

Merge this PR to deliver the scaffold files.

[qodo-code-review]

PR Summary by Qodo

Point Fullsend installation workflow to main

⚙️ Configuration changes 🕐 Less than 5 minutes

AI Description

• References Fullsend’s reusable dispatch workflow from the main branch.
• Enables per-repository installations to consume the latest scaffold workflow.

High-Level Assessment

The following are alternative approaches to this PR:

1. Use a versioned release tag

• ➕ Provides predictable behavior and controlled upgrades
• ➕ Reduces exposure to breaking upstream changes
• ➖ Requires a release containing the updated per-repository installation workflow
• ➖ May delay delivery of scaffold changes

2. Pin an immutable commit SHA

• ➕ Guarantees reproducible workflow execution
• ➕ Provides the strongest protection against unexpected upstream changes
• ➖ Requires explicit updates for every upstream change
• ➖ Makes the referenced version less readable

Recommendation: Using main is appropriate when immediate access to unreleased scaffold behavior is required. Once that behavior is released, prefer a versioned tag—or a commit SHA for maximum reproducibility—to avoid unexpected changes from a mutable branch.

Files changed (1) +1 / -1

Other (1) +1 / -1

fullsend.yamlReference Fullsend reusable workflow from main +1/-1

Reference Fullsend reusable workflow from main

• Changes the reusable dispatch workflow reference from 'v0' to 'main' while retaining per-repository installation mode. This allows the repository to consume the latest Fullsend scaffold workflow.

.github/workflows/fullsend.yaml

[qodo-code-review]

Code Review by Qodo

🐞 Bugs (1) 📘 Rule violations (0) 📜 Skill insights (0)

1. Mutable privileged workflow reference 🐞 Bug ⛨ Security

Description

Referencing @main allows every upstream branch update to execute here without repository review
under contents: write, actions: write, and id-token: write permissions. The invoked workflow
also receives cloud and telemetry secrets, so an accidental or malicious upstream change could
modify this repository or exfiltrate credentials.

Code

.github/workflows/fullsend.yaml[48]

+    uses: fullsend-ai/fullsend/.github/workflows/reusable-dispatch.yml@main

Relevance

●●● Strong

Recent accepted security precedents address unsafe code execution and credential exposure; this
privileged mutable workflow matches that pattern.

PR-#10

ⓘ Recommendations generated based on similar findings in past PRs

Evidence

The changed reference at line 48 loads workflow code from the moving upstream main branch. The
caller grants that code Actions, contents, and OIDC write permissions at lines 41-47 and passes
repository/cloud secrets at lines 55-59, demonstrating that unreviewed upstream changes execute with
privileged access.

.github/workflows/fullsend.yaml[41-48]
.github/workflows/fullsend.yaml[55-59]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
The reusable workflow is referenced through the mutable upstream `main` branch despite receiving privileged permissions and secrets. Pin it to the exact audited commit containing the required per-repository installation support.

## Issue Context
GitHub resolves `@main` whenever the workflow runs, allowing upstream changes to alter executed code without a reviewed update in this repository. The called workflow has write access, OIDC token issuance, and explicitly passed secrets.

## Fix Focus Areas
- .github/workflows/fullsend.yaml[41-59]

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

---

Context sources

✅ Compliance rules (platform): 19 rules

✅ Skills: writing-how-to

Tip of the day

💡 Did you know, you can keep summaries lean with Finding overflow, which tucks the rest behind 'View more'

More tips ↗ | Customize Qodo ↗ | Qodo docs ↗

[qodo-code-review]

1. Mutable privileged workflow reference 🐞 Bug ⛨ Security

Referencing @main allows every upstream branch update to execute here without repository review
under contents: write, actions: write, and id-token: write permissions. The invoked workflow
also receives cloud and telemetry secrets, so an accidental or malicious upstream change could
modify this repository or exfiltrate credentials.

Agent Prompt

## Issue description
The reusable workflow is referenced through the mutable upstream `main` branch despite receiving privileged permissions and secrets. Pin it to the exact audited commit containing the required per-repository installation support.

## Issue Context
GitHub resolves `@main` whenever the workflow runs, allowing upstream changes to alter executed code without a reviewed update in this repository. The called workflow has write access, OIDC token issuance, and explicitly passed secrets.

## Fix Focus Areas
- .github/workflows/fullsend.yaml[41-59]

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools