ci(#2403): remove dead RETRO_SANDBOX_TOKEN env var

[rh-hemartin]

Summary

• Remove unused RETRO_SANDBOX_TOKEN env var from reusable-retro.yml

Closes #2403

🤖 Generated with Claude Code

[github-actions]

Site preview

Preview: https://a5a63439-site.fullsend-ai.workers.dev

Commit: c8ea6227dd65a1022fd26840ef0da6ad3a84c243

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 10:16 AM UTC · Completed 10:28 AM UTC
Commit: 4c3e59d · View workflow run →

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[fullsend-ai-review]

Review

Findings

Medium

• [protected-path] .github/workflows/reusable-retro.yml — This file is under .github/, a protected path requiring human approval. The PR links to issue Remove dead RETRO_SANDBOX_TOKEN env var from reusable-retro workflow #2403 and explains the rationale (removing a dead env var). Human approval is always required for protected-path changes regardless of context.

Low

• [scope-alignment] .github/workflows/reusable-retro.yml:150-151 — The PR removes both RETRO_SANDBOX_TOKEN (line 150) and GH_TOKEN (line 151) from the "Run retro agent" step, but issue Remove dead RETRO_SANDBOX_TOKEN env var from reusable-retro workflow #2403 specifically requests removal of only "the dead RETRO_SANDBOX_TOKEN line." Removing GH_TOKEN is a necessary companion change (the retro.env update reads GH_TOKEN from the environment set by setup-agent-env.sh, matching the triage/prioritize pattern), so this is reasonable scope but slightly beyond the literal issue text.

Info

• [architectural-coherence] internal/scaffold/fullsend-repo/env/retro.env — The change from export GH_TOKEN="${RETRO_SANDBOX_TOKEN}" to `export GH_TOKEN=${GH... aligns the retro agent with the pattern used by triage, review, prioritize, and code-agent env files.

• [design-coherence] .github/workflows/reusable-retro.yml — After this change, retro follows the same token-passing pattern as triage and prioritize: (1) AGENT_GH_TOKEN set in "Setup agent environment" step, (2) setup-agent-env.sh strips prefix to GITHUB_ENV, (3) "Run agent" step has no token env vars, (4) env file reads GH_TOKEN from environment.

Previous run

Review

Findings

Critical

• [incomplete-migration] .github/workflows/reusable-retro.yml:150 — Removing RETRO_SANDBOX_TOKEN from the workflow env block breaks the retro agent. The env file internal/scaffold/fullsend-repo/env/retro.env line 6 reads export GH_TOKEN="${RETRO_SANDBOX_TOKEN}". The harness config retro.yaml sets expand: true for this file, meaning os.ExpandEnv will substitute the value at copy time. After this PR removes RETRO_SANDBOX_TOKEN from the run step's env block, the variable will expand to an empty string, leaving the sandbox with no GitHub token. The retro agent will fail on any GitHub API call.
  Remediation: Update internal/scaffold/fullsend-repo/env/retro.env line 6 from export GH_TOKEN="${RETRO_SANDBOX_TOKEN}" to export GH_TOKEN=${GH... to match the pattern used by code-agent.env, review.env, fix-agent.env, and triage.env. The GH_TOKENvariable is already available in the run step's env block (line 151) and viaGITHUB_ENVfromsetup-agent-env.sh`.

Medium

• [redundant-variable] .github/workflows/reusable-retro.yml:151 — Line 151 sets GH_TOKEN: ${{ steps.app-token.outputs.token }} in the run step's env block. This value is also set via GITHUB_ENV by setup-agent-env.sh. The explicit setting is not harmful and provides defense-in-depth, but it differs from workflows like triage and prioritize which do not set GH_TOKEN in the run step.

• [protected-path] .github/workflows/reusable-retro.yml — This file is under .github/ which is a protected path requiring human approval. The change is a one-line env var removal from a CI workflow. Human approval is always required for protected-path changes regardless of context.

[fullsend-ai-review]

See the review comment for full details.

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 11:56 AM UTC · Completed 12:07 PM UTC
Commit: c8ea622 · View workflow run →

[fullsend-ai-retro]

🤖 Finished Retro · ✅ Success · Started 1:53 PM UTC · Completed 1:59 PM UTC
Commit: c8ea622 · View workflow run →

[fullsend-ai-retro]

Retro: PR #2412 — Remove dead RETRO_SANDBOX_TOKEN env var

Verdict: Workflow performed well. No new proposals.

Timeline

1. Issue Remove dead RETRO_SANDBOX_TOKEN env var from reusable-retro workflow #2403 created (~06:47 UTC) — remove unused RETRO_SANDBOX_TOKEN from reusable-retro.yml
2. Issue triaged and labeled ready-to-code
3. PR ci(#2403): remove dead RETRO_SANDBOX_TOKEN env var #2412 opened by rh-hemartin at 10:12 UTC (human-authored with Claude Code) — initial commit removed RETRO_SANDBOX_TOKEN and GH_TOKEN from the workflow env block
4. Review bot ran at 10:28 UTC and correctly flagged a critical incomplete-migration bug: retro.env still referenced ${RETRO_SANDBOX_TOKEN}, so removing the workflow env var would leave the retro agent sandbox with no GitHub token
5. Author pushed a fix updating retro.env to use ${GH_TOKEN} directly
6. Human (ralphbean) approved at 12:00 UTC
7. Merged at 13:48 UTC

Assessment

• Review quality: Excellent. The review bot caught a real, critical bug on the first pass — an incomplete migration that would have broken the retro agent in production. This is exactly the kind of cross-file impact analysis reviews should catch.
• Rework rate: 1 iteration. The initial commit was incomplete, but rework was minimal — one additional commit to fix the env file. Acceptable for a 2-file, 7-line change.
• Token cost: Reasonable. Normal number of workflow dispatches. Some redundant issue-event runs were cancelled quickly.
• Time to resolution: ~3.5 hours from PR open to merge, which is fine for a change touching protected CI paths requiring human approval.

Why no proposals

• The review bot's cross-file impact analysis worked correctly here — it identified the dependency between the workflow env var and the env template file. This validates the current review approach.
• The pattern of studying sibling/related files is already tracked in #2414 (code agent should study sibling files for established patterns).
• This was a human-authored PR, so code agent improvements wouldn't have applied.
• No systemic issues identified that aren't already covered by existing open issues.