fix: silent skip when stage role not configured

[ralphbean]

Summary

• Change the defaults.roles gate in both dispatch workflows to exit 0 with a ::notice:: annotation instead of exit 1 with ::error:: when a stage's role is not configured
• Add id: role-check to the step and gate downstream steps (fan-out, fork-PR check) on steps.role-check.outputs.skipped != 'true'
• Per-repo dispatch clears the job stage output via a conditional expression so downstream jobs are skipped cleanly

Fixes #973

Test plan

• make go-vet passes
• make lint passes
• TestDispatchWorkflowContent passes
• Verify on a live org without retro agent that PR close no longer produces a failed workflow run

🤖 Generated with Claude Code

[github-actions]

fullsend review is working on this — view logs

[github-actions]

Site preview

Preview: https://6caaad57-site.fullsend-ai.workers.dev

Commit: dd6e9673d6650b86087852ce05b826ce09633aff

[fullsend-ai-review]

Review

Findings

High

• [correctness] .github/workflows/reusable-dispatch.yml:52 — GHA expression logic error: stage output is never cleared when role-check skips. The expression steps.role-check.outputs.skipped == 'true' && '' || steps.route.outputs.stage always evaluates to steps.route.outputs.stage because '' is falsy in GitHub Actions expression evaluation. When skipped == 'true': true && '' yields '', then '' || steps.route.outputs.stage yields the original stage value. This means per-repo mode downstream jobs (triage, code, review, fix, retro) will still run for unconfigured roles, defeating the purpose of the fix.
  Remediation: Flip the conditional — use steps.role-check.outputs.skipped != 'true' && steps.route.outputs.stage || ''. When skipped: false && stage || '' → ''. When not skipped: true && stage || '' → stage.

Medium

• [protected-path] .github/workflows/reusable-dispatch.yml — This file is under .github/, a protected path requiring human approval. The PR links to Shim dispatches retro stage on PR close even when org has no retro agent configured #973 and explains the rationale for the change. Human review is still required regardless of code correctness.

Low

• [correctness] .github/workflows/reusable-dispatch.yml:275 — The "Build event payload" step's if condition (steps.route.outputs.stage != '') does not check steps.role-check.outputs.skipped != 'true'. If the expression bug above is fixed, this step would still run unnecessarily (building a payload for a skipped stage). Harmless but inconsistent with the guard pattern applied to the fork-PR step.
  Remediation: Add && steps.role-check.outputs.skipped != 'true' to the step's if condition.

Previous run

Review: #1022

Head SHA: 92335d4
Timestamp: 2026-05-15T00:00:00Z
Outcome: request-changes

Summary

The PR correctly converts the role-check gate from a hard failure (exit 1 + ::error::) to a silent skip (exit 0 + ::notice::) in both dispatch workflows, matching the intent of #973. However, reusable-dispatch.yml has a gap: the "Block fork PRs for fix stage" step is not guarded by the new role-check.outputs.skipped flag. In the per-org dispatch.yml, this guard was correctly added, but the reusable workflow omits it. If the fix role is unconfigured and a fork PR triggers the fix stage, the fork-PR check will still run and can exit 1 — producing the exact noisy failure this PR aims to eliminate.

Findings

Medium

• [Correctness] .github/workflows/reusable-dispatch.yml:255 — The "Block fork PRs for fix stage" step condition (steps.route.outputs.stage == 'fix' && github.event.issue.pull_request) is not guarded by steps.role-check.outputs.skipped != 'true'. The per-org dispatch.yml (line 270 in diff) correctly adds this guard, but the reusable workflow does not. If the fix role is unconfigured and the event is a fork PR, this step runs and can fail with exit 1, defeating the silent-skip intent.
  Remediation: Add && steps.role-check.outputs.skipped != 'true' to the if condition on the fork-PR step in reusable-dispatch.yml, matching the pattern used in dispatch.yml.

Low

• [Correctness] .github/workflows/reusable-dispatch.yml:276 — The "Build event payload" step runs when steps.route.outputs.stage != '' without checking role-check skip. It builds a payload that downstream jobs will never consume (since the job output clears stage). Not harmful, but inconsistent with the per-org dispatch where the fan-out step is guarded.
  Remediation: Add && steps.role-check.outputs.skipped != 'true' to the if condition on the payload step, or accept the minor inconsistency.

Footer

Outcome: request-changes
This review applies to SHA 92335d47c22e663918a62e56cc191842fa9c01be. Any push to the PR head clears this review and requires a new evaluation.

[fullsend-ai-review]

See the review comment for full details.

[github-actions]

fullsend fix is working on this — view logs