fix(workflows): configure git identity for runner amends

[rh-hemartin]

Summary

Fixes #2910 — code/fix agent runs failed when pre-commit hooks auto-fixed files because post-code.sh amend operations ran on the runner without git identity configured.

Changes

• Add git config user.email/user.name in reusable-code.yml after bot identity resolution
• Add git config user.email/user.name in reusable-fix.yml after bot identity resolution

Root cause

The workflows resolved BOT_LOGIN and GIT_BOT_EMAIL but never called git config with them. The sandbox has identity via env vars (GIT_AUTHOR_EMAIL, GIT_COMMITTER_EMAIL) from code.yaml, but post-code.sh executes outside the sandbox on the runner.

When pre-commit hooks auto-fixed files (line 323) or artifacts were stripped (line 198), git commit --amend --no-edit failed with "Committer identity unknown".

Test plan

• Trigger code agent on issue that produces Go formatting issues
• Verify pre-commit hook auto-fix succeeds
• Verify amend completes with bot identity
• Check commit author/committer match bot

🤖 Generated with Claude Code

[fullsend-ai-review]

🤖 Review · ⚠️ Cancelled · Started 9:57 AM UTC · Ended 10:05 AM UTC
Commit: 9f4f2b6 · View workflow run →

[qodo-code-review]

PR Summary by Qodo

Configure git identity in reusable workflows for runner amend commits

🐞 Bug fix ⚙️ Configuration changes 🕐 10-20 Minutes

AI Description

• Configure user.name/user.email in reusable workflows after resolving bot identity.
• Prevent runner-side git commit --amend --no-edit failures when hooks auto-fix files.
• Align runner git identity with the bot login/email already exported to the environment.

Diagram

graph TD
  RC["reusable-code.yml"] --> RES["Resolve bot identity"] --> CFG["git config name/email"] --> POST["post-code.sh"] --> AMEND["git commit --amend"]
  RF["reusable-fix.yml"] --> RES

Loading

High-Level Assessment

The following are alternative approaches to this PR:

1. Set GIT_AUTHOR_*/GIT_COMMITTER_* env vars for runner steps

• ➕ Avoids modifying git config state in the workspace
• ➕ Keeps identity scoped to specific commands/steps
• ➖ Easy to miss for future steps/scripts unless consistently applied everywhere
• ➖ Doesn’t help if tooling relies on git config rather than env vars

2. Configure git identity inside post-code.sh before amend

• ➕ Puts the fix closest to the failing command
• ➕ Covers any caller of post-code.sh regardless of workflow entrypoint
• ➖ Requires updating script logic and ensuring bot identity is available there
• ➖ May duplicate identity resolution concerns across layers

Recommendation: Current approach is a good balance: workflows already resolve BOT_LOGIN/GIT_BOT_EMAIL, and setting git config immediately after that ensures any subsequent runner-side amend commits (including those triggered by pre-commit auto-fixes) have a valid committer identity. Consider the post-code.sh approach only if other entrypoints invoke the same amend logic without going through these reusable workflows.

Files changed (2) +4 / -0

Bug fix (2) +4 / -0

reusable-code.ymlSet runner git user.name/email after bot identity resolution +2/-0

Set runner git user.name/email after bot identity resolution

• Adds 'git config user.email' and 'git config user.name' using the resolved bot email/login. This ensures runner-side amend commits invoked after the sandbox phase have a valid committer identity.

.github/workflows/reusable-code.yml

reusable-fix.ymlSet runner git user.name/email after bot identity resolution +2/-0

Set runner git user.name/email after bot identity resolution

• Mirrors the reusable-code workflow fix by configuring git identity on the runner using the resolved bot email/login. Prevents amend failures during fix-agent runs when files are auto-modified and a no-edit amend is attempted.

.github/workflows/reusable-fix.yml

[github-actions]

Site preview

Preview: https://45875a28-site.fullsend-ai.workers.dev

Commit: 1329c6d6695ca36e9dd31ef8530c1ca7012d7aae

[qodo-code-review]

Code Review by Qodo

🐞 Bugs (0) 📘 Rule violations (0) 📎 Requirement gaps (0) 📜 Skill insights (0)

Context used

✅ Tickets: 🎫 Code agent runs fail when pre-commit auto-fixes files: git identity not configured on runner for amend

✅ Compliance rules (platform): 54 rules

✅ Skills: writing-user-docs, writing-adrs

1. Git config targets wrong repo ✓ Resolved 🐞 Bug ☼ Reliability

Description

In reusable-code.yml/reusable-fix.yml, git config user.* is currently run in the workflow’s
default workspace (and in the fix flow even before target-repo is checked out) without --global,
so it configures the config repo rather than the checked-out ${GITHUB_WORKSPACE}/target-repo.
Because post-code.sh/post-fix.sh cd "$REPO_DIR" and then run git commit --amend, the amend
can still fail in the target repo with “Committer identity unknown”.

Code

.github/workflows/reusable-code.yml[R173-174]

+          git config user.email "${GIT_BOT_EMAIL}"
+          git config user.name "${BOT_LOGIN}"

Relevance

⭐⭐⭐ High

Team often accepts workflow reliability hardening; many similar GH Actions robustness fixes accepted
(PRs 2398, 2617, 2106).

PR-#2398
PR-#2617
PR-#2106

ⓘ Recommendations generated based on similar findings in past PRs

Evidence

The cited workflow steps set user.name/user.email without scoping the config to target-repo
(and in the fix workflow do so before the target repository exists), which means the identity is
applied to whatever repository is in the runner’s current working directory at that moment. The
harnesses define REPO_DIR as ${GITHUB_WORKSPACE}/target-repo, and the post scripts explicitly
change into that directory before executing git commit --amend --no-edit, so the repository
performing the amend can still lack the configured identity, leading to the committer identity
error.

.github/workflows/reusable-code.yml[135-175]
internal/scaffold/fullsend-repo/harness/code.yaml[51-60]
internal/scaffold/fullsend-repo/scripts/post-code.sh[49-58]
internal/scaffold/fullsend-repo/scripts/post-code.sh[318-324]
.github/workflows/reusable-fix.yml[151-165]
.github/workflows/reusable-fix.yml[312-329]
internal/scaffold/fullsend-repo/harness/fix.yaml[66-77]
internal/scaffold/fullsend-repo/scripts/post-fix.sh[66-75]
internal/scaffold/fullsend-repo/scripts/post-fix.sh[229-235]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
`git config user.email/user.name` is being applied to the wrong repository (the workflow workspace/config repo) and, in the fix workflow, may run before `target-repo` is even checked out; meanwhile the post scripts perform `git commit --amend` inside `${GITHUB_WORKSPACE}/target-repo`, so that repo can still lack committer identity and fail with “Committer identity unknown”.

## Issue Context
- The harnesses set `REPO_DIR` to `${GITHUB_WORKSPACE}/target-repo` for GitHub runs.
- `post-code.sh` / `post-fix.sh` explicitly `cd` into `REPO_DIR` before running `git commit --amend --no-edit`.
- The workflows currently run `git config user.*` without `--global` and without scoping to `target-repo` (and in `reusable-fix.yml` this happens before the target repo checkout), so the config does not necessarily apply where the amend occurs.

## Fix Focus Areas
- .github/workflows/reusable-code.yml[135-175]
- internal/scaffold/fullsend-repo/harness/code.yaml[51-60]
- internal/scaffold/fullsend-repo/scripts/post-code.sh[49-58]
- internal/scaffold/fullsend-repo/scripts/post-code.sh[318-324]
- .github/workflows/reusable-fix.yml[151-165]
- .github/workflows/reusable-fix.yml[312-329]
- internal/scaffold/fullsend-repo/harness/fix.yaml[66-77]
- internal/scaffold/fullsend-repo/scripts/post-fix.sh[66-75]
- internal/scaffold/fullsend-repo/scripts/post-fix.sh[229-235]

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

---

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 10:06 AM UTC · Completed 10:14 AM UTC
Commit: 1329c6d · View workflow run →

[fullsend-ai-review]

Review

Findings

Medium

• [protected-path] .github/workflows/reusable-code.yml, .github/workflows/reusable-fix.yml — This PR modifies files under the protected .github/ path. Human approval is always required for protected-path changes. The PR links to issue Code agent runs fail when pre-commit auto-fixes files: git identity not configured on runner for amend #2910 and explains the rationale (git identity not configured on runner for amend operations).

---

Labels: PR fixes CI workflow files for code/fix agent runners

[ralphbean]

LGTM.

[fullsend-ai-retro]

🤖 Finished Retro · ✅ Success · Started 1:29 PM UTC · Completed 1:35 PM UTC
Commit: 1329c6d · View workflow run →

[fullsend-ai-retro]

Retro: PR #2911 — fix git identity for runner amends

Timeline: Issue #2910 filed at 09:35 UTC reporting code agent failures when pre-commit auto-fixes triggered git commit --amend on the runner without git identity configured. The code agent was dispatched but failed (Terminated/Failure) — expected, since the fix required modifying .github/workflows/ files which are protected. Human (rh-hemartin) wrote the 4-line fix, opened PR #2911 at 09:57, received two human approvals, and merged at 13:27. Total time: ~4 hours.

Review quality: The fullsend review agent flagged only the mechanical protected-path finding (medium severity, human approval required). The qodo bot raised a scoping concern about --global that was already addressed in the merged code. No substantive issues were missed in the review of this PR.

Root cause: PR #2852 (merged 2026-07-01) added pre-commit auto-fix retry logic with git commit --amend in post-code.sh, but didn't configure git identity on the runner. The regression went undetected for ~1 day because no code agent run triggered the auto-fix path until run 28577806406.

Existing coverage: Several candidate proposals were filtered because existing open issues already cover them:

• Code agent dispatched for .github/ changes it can't modify → #2290, #1888
• Protected-path finding on human-authored PRs → #1551
• Review cancellation/dedup → #2388, #1372, and others

One new proposal targets a review quality gap in the original PR #2852 that introduced the regression.

Proposals filed

• Review agent should verify execution-context prerequisites for new shell operations in post-scripts (in fullsend-ai/fullsend)