feat(harness): report categorized post-script failures on issue/PR (#2908) by ifireball · Pull Request #2921 · fullsend-ai/fullsend

ifireball · 2026-07-02T13:26:56Z

Summary

Add shared post-failure-report.sh library with categorized failure comments, output sanitization, and workflow run links
post-code.sh posts detailed failure comments on the issue (push rejected, pre-commit blocked, secret scan, PR creation failed, etc.)
post-fix.sh posts equivalent failure comments on the PR (previously silent on post-script failures)
Workflow-permission push rejections are called out explicitly as environmental limitations
Extend post-code-test.sh / post-fix-test.sh coverage and wire post-fix-test.sh into make script-test

Test plan

bash internal/scaffold/fullsend-repo/scripts/post-code-test.sh
bash internal/scaffold/fullsend-repo/scripts/post-fix-test.sh
make lint on staged files
CI green including Codecov

Made with Cursor

…ullsend-ai#2908) When post-code or post-fix fails after the agent completes, post a comment with the failure category, sanitized output, workflow run link, and an explicit note for workflow-permission push rejections. Signed-off-by: Barak Korren <bkorren@redhat.com> Co-authored-by: Cursor <cursoragent@cursor.com>

fullsend-ai-review · 2026-07-02T13:27:55Z

🤖 Finished Review · ✅ Success · Started 1:27 PM UTC · Completed 1:39 PM UTC
Commit: a5937fa · View workflow run →

qodo-code-review · 2026-07-02T13:28:55Z

PR Summary by Qodo

feat(harness): report categorized post-script failures on issue/PR

✨ Enhancement 🧪 Tests 🕐 20-40 Minutes

AI Description

• Introduce shared lib/post-failure-report.sh library providing categorized failure comments,
 output sanitization (token redaction), workflow run links, and environmental notes for
 workflow-permission push rejections.
• Refactor post-code.sh and post-fix.sh to replace bare exit 1 calls with
 post_fail_to_issue/post_fail_to_pr, posting structured failure comments on the issue or PR
 respectively.
• Extend post-code-test.sh and post-fix-test.sh with tests for failure comment content,
 sanitization, and push categorization; wire post-fix-test.sh into make script-test.

Diagram

graph TD
  MK["Makefile\nscript-test"] --> PCT["post-code-test.sh"]
  MK --> PFT["post-fix-test.sh"]
  PCT --> LIB["lib/post-failure-report.sh"]
  PFT --> LIB
  PC["post-code.sh"] --> LIB
  PF["post-fix.sh"] --> LIB
  LIB --> GH_ISSUE(["gh issue comment"])
  LIB --> GH_PR(["gh pr comment"])

  subgraph Legend
    direction LR
    _file["Script/File"] ~~~ _api(["GitHub CLI API"])
  end

High-Level Assessment

Extracting the failure-reporting logic into a shared library is the right approach here. The alternative — keeping inline functions in each post-script — was already in place and caused the gap (post-fix.sh had no reporting at all). A separate reporting service or GitHub Actions step was considered but would add deployment complexity for what is fundamentally a best-effort comment. The shared-library pattern keeps the scripts self-contained and testable without external dependencies.

Files changed (6) +463 / -161

Enhancement (2) +264 / -71

post-failure-report.shNew shared library for categorized, sanitized post-script failure reporting +218/-0

New shared library for categorized, sanitized post-script failure reporting

• Introduces a new 218-line bash library providing: 'sanitize_failure_detail' (redacts tokens/keys), 'categorize_push_failure' (maps push output to category slugs), 'build_post_failure_comment' (assembles a structured markdown comment), and 'report_post_failure_to_issue'/'report_post_failure_to_pr' (posts via 'gh' CLI). Includes 'post_fail_to_issue'/'post_fail_to_pr' convenience wrappers that set category, post, and exit. Guard against double-reporting via 'POST_FAILURE_REPORTED' flag.

internal/scaffold/fullsend-repo/scripts/lib/post-failure-report.sh

post-code.shReplace bare exit-1 calls with categorized post_fail_to_issue reporting +46/-71

Replace bare exit-1 calls with categorized post_fail_to_issue reporting

• Sources the new 'post-failure-report.sh' library and installs a 'trap 'report_post_failure_to_issue' ERR'. All 'exit 1' failure paths (setup error, branch validation, secret scan, signed-off-by, pre-commit blocked, push rejected, PR creation failed) are replaced with 'post_fail_to_issue <category> <detail>', capturing command output for inclusion in the comment. Removes the previously inline 'report_failure_to_issue' function.

internal/scaffold/fullsend-repo/scripts/post-code.sh

Bug fix (1) +45 / -35

post-fix.shAdd categorized failure reporting to post-fix.sh (previously silent on failure) +45/-35

Add categorized failure reporting to post-fix.sh (previously silent on failure)

• Sources 'post-failure-report.sh' and installs a 'trap 'report_post_failure_to_pr' ERR'. All 'exit 1' paths (setup error, secret scan, signed-off-by, pre-commit blocked, push rejected, process-output failed) are replaced with 'post_fail_to_pr <category> <detail>', posting structured comments on the PR. This closes a gap where post-fix failures were silent to the PR author.

internal/scaffold/fullsend-repo/scripts/post-fix.sh

Tests (2) +153 / -55

post-code-test.shRefactor error-comment tests to use shared library; add sanitize and categorize tests +97/-55

Refactor error-comment tests to use shared library; add sanitize and categorize tests

• Sources 'post-failure-report.sh' and replaces the local 'build_error_comment' reimplementation with direct calls to 'build_post_failure_comment'. Renames 'run_error_comment_test' to 'run_failure_comment_test' with an updated signature (adds category/detail). Adds 'run_sanitize_test' cases for token redaction and 'run_categorize_push_test' cases for push-failure classification.

internal/scaffold/fullsend-repo/scripts/post-code-test.sh

post-fix-test.shAdd failure-comment test coverage for post-fix.sh scenarios +56/-0

Add failure-comment test coverage for post-fix.sh scenarios
• Sources 'post-failure-report.sh' and adds a 'run_fix_failure_comment_test' helper plus six test cases covering push-rejected, workflow-permission, pre-commit, secret-scan sanitization, retry hint, and workflow link presence in fix-agent failure comments.
internal/scaffold/fullsend-repo/scripts/post-fix-test.sh

Other (1) +1 / -0

MakefileWire post-fix-test.sh into make script-test target +1/-0

Wire post-fix-test.sh into make script-test target
• Adds 'post-fix-test.sh' to the 'script-test' Makefile target so it runs alongside the other post-script tests in CI.
Makefile

github-actions · 2026-07-02T13:29:31Z

Site preview

Preview: https://1d381f7b-site.fullsend-ai.workers.dev

Commit: aa9e0559a4e9ee7b66b6660c05b54b4e9719bd0e

codecov · 2026-07-02T13:31:38Z

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

qodo-code-review · 2026-07-02T13:32:10Z

Code Review by Qodo

🐞 Bugs (1) 📘 Rule violations (0) 📎 Requirement gaps (0) 📜 Skill insights (0)

Context used

✅ Tickets: 🎫 harness: report push and post-script failures on issue/PR with reason

✅ Compliance rules (platform): 61 rules

✅ Skills: writing-user-docs, writing-adrs

1. ~~Undefined post_fail call~~ ✓ Resolved 🐞 Bug ≡ Correctness

Description

post-code.sh and post-fix.sh call post_fail_to_issue/post_fail_to_pr before sourcing
post-failure-report.sh, so the early setup-error path (missing REPO_DIR) fails with "command not
found" and does not post the intended failure comment. Any error before the new source/trap lines
will similarly bypass the new reporting.

Code

internal/scaffold/fullsend-repo/scripts/post-code.sh[R52-67]

if [ "${REPO_DIR}" != "." ]; then
  if [ ! -d "${REPO_DIR}" ]; then
    echo "::error::Extracted repo not found at ${REPO_DIR}" >&2
-    exit 1
+    post_fail_to_issue setup-error "Extracted repo not found at ${REPO_DIR}"
  fi
  cd "${REPO_DIR}"
fi

: "${PUSH_TOKEN:?PUSH_TOKEN is required}"
: "${REPO_FULL_NAME:?REPO_FULL_NAME is required}"
: "${ISSUE_NUMBER:?ISSUE_NUMBER is required}"
+
+SCRIPT_DIR_POST="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+# shellcheck source=lib/post-failure-report.sh
+source "${SCRIPT_DIR_POST}/lib/post-failure-report.sh"
+trap 'report_post_failure_to_issue' ERR

Relevance

⭐⭐⭐ High
Team regularly accepts bash correctness fixes in these scripts (e.g., guard/env fixes merged in
#2456).
PR-#2456

ⓘ Recommendations generated based on similar findings in past PRs

Evidence
Both post scripts call the new post_fail_* helper before sourcing the file that defines it, so Bash
will error out before posting any comment.
internal/scaffold/fullsend-repo/scripts/post-code.sh[49-67]
internal/scaffold/fullsend-repo/scripts/post-fix.sh[66-86]
internal/scaffold/fullsend-repo/scripts/lib/post-failure-report.sh[204-218]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
`post_fail_to_issue` / `post_fail_to_pr` are invoked before `lib/post-failure-report.sh` is sourced, so the scripts crash on the first failure path that uses these helpers and cannot post a categorized failure comment.

## Issue Context
Both scripts attempt to use the helper in the `REPO_DIR` existence check, but only source the helper later.

## Fix Focus Areas
- internal/scaffold/fullsend-repo/scripts/post-code.sh[49-67]
- internal/scaffold/fullsend-repo/scripts/post-fix.sh[66-86]

## Suggested fix
Move `SCRIPT_DIR_POST=...; source .../lib/post-failure-report.sh; trap ... ERR` to the very top of the script (immediately after `set -euo pipefail`, and before any early-exit validation), or keep the early setup checks using plain `echo`+`exit 1` until after sourcing.
Ensure the trap is set immediately after sourcing so unexpected early failures also get reported.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

2. secret-scan comments include gitleaks output ✓ Resolved 📎 Requirement gap ⛨ Security

Description

On secret-scan failures, the scripts pass full gitleaks detect output into the public issue/PR
comment detail block. This can disclose secret-scan findings (even if redacted) instead of providing
only a sanitized, actionable reason with a workflow link.

Code

internal/scaffold/fullsend-repo/scripts/post-code.sh[R219-221]

+if ! GITLEAKS_OUTPUT="$(gitleaks detect --source . --log-opts="${SCAN_RANGE}" --redact 2>&1)"; then
+  post_fail_to_issue secret-scan "${GITLEAKS_OUTPUT}"
+fi

Relevance

⭐⭐ Medium
No historical evidence on excluding gitleaks output from posted failure comments; mixed precedent on
sharing sanitized details.
ⓘ Recommendations generated based on similar findings in past PRs

Evidence
The rule requires post-script failure comments to include a category, a sanitized reason, and a
workflow run link, and explicitly lists including secret scan findings as a failure condition. The
code captures full gitleaks output and passes it directly into the comment builder, which renders
it under a **Details:** block in the posted comment.
Post-script failures must be reported as issue/PR comments with category, sanitized reason, and workflow link
internal/scaffold/fullsend-repo/scripts/post-code.sh[219-221]
internal/scaffold/fullsend-repo/scripts/post-fix.sh[163-165]
internal/scaffold/fullsend-repo/scripts/lib/post-failure-report.sh[101-127]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
`post-code.sh`/`post-fix.sh` post secret-scan failure comments that include the `gitleaks` output in the comment body. The compliance requirement explicitly disallows including secret scan findings in failure comments; only a category, sanitized actionable reason, and workflow link should be posted.

## Issue Context
- `post_fail_to_issue secret-scan "${GITLEAKS_OUTPUT}"` and `post_fail_to_pr secret-scan "${GITLEAKS_OUTPUT}"` feed scan output directly into `build_post_failure_comment`, which renders a `**Details:**` code block.
- Even with `gitleaks --redact`, the output can still constitute “secret scan findings” (file paths, rule IDs, commit references, etc.).

## Fix Focus Areas
- internal/scaffold/fullsend-repo/scripts/post-code.sh[219-221]
- internal/scaffold/fullsend-repo/scripts/post-fix.sh[163-165]
- internal/scaffold/fullsend-repo/scripts/lib/post-failure-report.sh[101-127]

## Implementation direction
- For category `secret-scan`, do not include raw `gitleaks` output in the posted comment.
- Replace with a short sanitized message such as: "Secret scan blocked; see workflow logs for details." and keep the workflow link.
- Option A: Special-case `secret-scan` inside `build_post_failure_comment` to suppress `detail_block`.
- Option B: When calling `post_fail_to_issue`/`post_fail_to_pr` for `secret-scan`, pass a generic detail message instead of `${GITLEAKS_OUTPUT}`.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

3. ~~PEM redaction ineffective~~ ✓ Resolved 🐞 Bug ⛨ Security

Description

sanitize_failure_detail attempts to redact PRIVATE KEY blocks using a single-line sed regex, which
will not match typical multi-line PEM blocks; a multi-line key present in failure output could be
posted to an issue/PR comment unredacted. This undermines the new “sanitized detail” feature.

Code

internal/scaffold/fullsend-repo/scripts/lib/post-failure-report.sh[R26-44]

+# Strip tokens and truncate noisy command output before posting publicly.
+sanitize_failure_detail() {
+  local detail="$1"
+  local max_lines="${2:-${POST_FAILURE_DETAIL_MAX_LINES}}"
+
+  detail="$(printf '%s\n' "${detail}" \
+    | sed -E \
+      -e 's/ghp_[A-Za-z0-9_]+/[REDACTED]/g' \
+      -e 's/github_pat_[A-Za-z0-9_]+/[REDACTED]/g' \
+      -e 's/x-access-token:[^@[:space:]]+/x-access-token:[REDACTED]/g' \
+      -e 's/(Bearer|token)[[:space:]]+[A-Za-z0-9._-]+/\1 [REDACTED]/gi' \
+      -e 's/-----BEGIN [A-Z ]*PRIVATE KEY-----[^-]*-----END [A-Z ]*PRIVATE KEY-----/[REDACTED PRIVATE KEY]/g')"
+
+  if [ "${max_lines}" -gt 0 ]; then
+    detail="$(printf '%s\n' "${detail}" | tail -n "${max_lines}")"
+  fi
+
+  printf '%s' "${detail}"
+}

Relevance

⭐⭐ Medium
No prior reviews about PEM multi-line key redaction in comment sanitizers found.
ⓘ Recommendations generated based on similar findings in past PRs

Evidence

The sanitizer explicitly tries to match a full PRIVATE KEY block in a single sed substitution, but
it’s applied line-by-line, so multi-line PEM blocks won’t match and will pass through.

internal/scaffold/fullsend-repo/scripts/lib/post-failure-report.sh[26-44]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
The PRIVATE KEY redaction uses line-oriented `sed`, so multi-line PEM blocks (the common format) will not be redacted.

## Issue Context
This sanitizer output is included in issue/PR comments; failing to redact multi-line PEM blocks risks secret disclosure.

## Fix Focus Areas
- internal/scaffold/fullsend-repo/scripts/lib/post-failure-report.sh[26-44]

## Suggested fix
Replace the sed-based PEM substitution with a multiline-capable approach, e.g.:
- Use `perl -0777 -pe 's/-----BEGIN [A-Z ]*PRIVATE KEY-----.*?-----END [A-Z ]*PRIVATE KEY-----/[REDACTED PRIVATE KEY]/sg'`
- Or implement a small stateful filter (awk) that drops lines between BEGIN/END markers.
Add/extend tests to include a multi-line PEM sample and assert it becomes `[REDACTED PRIVATE KEY]`.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

4. GHA command injection logs 🐞 Bug ⛨ Security

Description

post-code.sh and post-fix.sh echo captured pre-commit and push outputs directly to stdout; if that
output contains GitHub Actions workflow-command syntax (lines beginning with "::" or encoded
newlines), it can inject annotations/masking/grouping commands into the workflow log. The repo
already treats this as a security concern elsewhere via output sanitization before emitting GHA
commands.

Code

internal/scaffold/fullsend-repo/scripts/post-code.sh[R285-292]

+    PRECOMMIT_OUTPUT=""
+    if PRECOMMIT_OUTPUT="$(pre-commit run --files "${changed_array[@]}" 2>&1)"; then
+      echo "${PRECOMMIT_OUTPUT}"
      echo "Pre-commit passed — all hooks clean"
    else
+      echo "${PRECOMMIT_OUTPUT}"
      # Single retry only — do not convert to a loop without adding a cap.
      # Scope detection/staging to changed_array so hooks can't inject files

Relevance

⭐ Low
Similar “sanitize raw stdout logs” suggestions were rejected (e.g., COMMENT_BODY echo injection
concern in #1698).
PR-#1698

ⓘ Recommendations generated based on similar findings in past PRs

Evidence
The post scripts print pre-commit/push outputs verbatim, and the repo has an established pattern
that sanitizes :: and encoded newlines specifically to prevent GitHub Actions workflow-command
injection.
internal/scaffold/fullsend-repo/scripts/post-code.sh[280-336]
internal/scaffold/fullsend-repo/scripts/post-code.sh[379-395]
internal/scaffold/fullsend-repo/scripts/post-fix.sh[224-281]
internal/scaffold/fullsend-repo/scripts/post-fix.sh[298-314]
internal/scaffold/fullsend-repo/scripts/extract-transcript-error.sh[80-89]
PR-#2306

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
Captured tool output (notably pre-commit hooks and git push stderr) is echoed verbatim into GitHub Actions logs. If that output contains `::` workflow commands or `%0a/%0d` sequences, it can alter workflow log interpretation (annotation injection / masking).

## Issue Context
The repository already sanitizes untrusted text before emitting GHA annotations to prevent this class of issue.

## Fix Focus Areas
- internal/scaffold/fullsend-repo/scripts/post-code.sh[285-336]
- internal/scaffold/fullsend-repo/scripts/post-code.sh[379-395]
- internal/scaffold/fullsend-repo/scripts/post-fix.sh[229-281]
- internal/scaffold/fullsend-repo/scripts/post-fix.sh[298-314]
- internal/scaffold/fullsend-repo/scripts/extract-transcript-error.sh[80-89]

## Suggested fix
Before printing untrusted multi-line outputs, sanitize them similarly to `extract-transcript-error.sh`, e.g.:
- `SAFE_OUT=${OUT//::/ :}`
- strip both `%0A/%0a` and `%0D/%0d`
Then `printf '%s\n' "$SAFE_OUT"`.
Alternatively, avoid echoing raw tool output entirely and only include it in the (already sanitized) issue/PR comment.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

fullsend-ai-review · 2026-07-02T13:39:18Z

Looks good to me

Previous run

Review

Findings

High

[logic-error] internal/scaffold/fullsend-repo/scripts/post-code.sh:55 — post_fail_to_issue is called before the library that defines it is sourced. The REPO_DIR existence check (~line 55) calls post_fail_to_issue, but lib/post-failure-report.sh is not sourced until after the required-variable checks (~line 66). If REPO_DIR points to a missing directory, bash will fail with post_fail_to_issue: command not found instead of posting a useful failure comment.
Remediation: Move source "${SCRIPT_DIR_POST}/lib/post-failure-report.sh" (and the SCRIPT_DIR_POST computation) above the REPO_DIR existence check, or revert this early error path to exit 1 since the failure-reporting infrastructure is not yet initialized.
[logic-error] internal/scaffold/fullsend-repo/scripts/post-fix.sh:72 — Same issue: post_fail_to_pr is called before the library that defines it is sourced. The REPO_DIR check (~line 72) calls post_fail_to_pr, but lib/post-failure-report.sh is not sourced until after the required-variable checks (~line 83). If REPO_DIR points to a missing directory, bash will fail with post_fail_to_pr: command not found.
Remediation: Move the source and trap setup above the REPO_DIR existence check, or revert this early error path to exit 1.

Medium

[secrets-handling] internal/scaffold/fullsend-repo/scripts/lib/post-failure-report.sh:49 — sanitize_failure_detail() does not redact GitHub App installation tokens (ghs_*), OAuth tokens (gho_*), or user-to-server tokens (ghu_*). The function covers ghp_ and github_pat_ patterns but misses other GitHub token prefixes. If a failure output contains one of these token types, it would be posted verbatim in a public issue/PR comment.
Remediation: Add sed expressions for the missing prefixes, e.g. -e 's/gh[pousr]_[A-Za-z0-9_]\{36,\}/[REDACTED]/g'.

Labels: PR adds a shared failure-reporting library and modifies post-code/post-fix harness scripts, fitting the component/harness and feature labels.

Previous run

Looks good to me

Previous run (2)

Review

Findings

High

[logic-error] internal/scaffold/fullsend-repo/scripts/post-code.sh:55 — post_fail_to_issue is called before the library that defines it is sourced. The REPO_DIR existence check (~line 55) calls post_fail_to_issue, but lib/post-failure-report.sh is not sourced until after the required-variable checks (~line 66). If REPO_DIR points to a missing directory, bash will fail with post_fail_to_issue: command not found instead of posting a useful failure comment.
Remediation: Move source "${SCRIPT_DIR_POST}/lib/post-failure-report.sh" (and the SCRIPT_DIR_POST computation) above the REPO_DIR existence check, or revert this early error path to exit 1 since the failure-reporting infrastructure is not yet initialized.
[logic-error] internal/scaffold/fullsend-repo/scripts/post-fix.sh:72 — Same issue: post_fail_to_pr is called before the library that defines it is sourced. The REPO_DIR check (~line 72) calls post_fail_to_pr, but lib/post-failure-report.sh is not sourced until after the required-variable checks (~line 83). If REPO_DIR points to a missing directory, bash will fail with post_fail_to_pr: command not found.
Remediation: Move the source and trap setup above the REPO_DIR existence check, or revert this early error path to exit 1.

Medium

[secrets-handling] internal/scaffold/fullsend-repo/scripts/lib/post-failure-report.sh:49 — sanitize_failure_detail() does not redact GitHub App installation tokens (ghs_*), OAuth tokens (gho_*), or user-to-server tokens (ghu_*). The function covers ghp_ and github_pat_ patterns but misses other GitHub token prefixes. If a failure output contains one of these token types, it would be posted verbatim in a public issue/PR comment.
Remediation: Add sed expressions for the missing prefixes, e.g. -e 's/gh[pousr]_[A-Za-z0-9_]\{36,\}/[REDACTED]/g'.

Labels: PR adds a shared failure-reporting library and modifies post-code/post-fix harness scripts, fitting the component/harness and feature labels.

…t-failure-reporting Signed-off-by: Barak Korren <bkorren@redhat.com>

fullsend-ai-review · 2026-07-02T13:55:37Z

🤖 Review · ⚠️ Cancelled · Started 1:55 PM UTC · Ended 2:00 PM UTC
Commit: 9f4f2b6 · View workflow run →

…ai#2908) Source failure-report helpers before early exits, omit gitleaks output from public secret-scan comments, and broaden token/PEM sanitization. Signed-off-by: Barak Korren <bkorren@redhat.com> Co-authored-by: Cursor <cursoragent@cursor.com>

fullsend-ai-review · 2026-07-02T14:01:04Z

🤖 Finished Review · ✅ Success · Started 2:01 PM UTC · Completed 2:13 PM UTC
Commit: 446654e · View workflow run →

Superseded by updated review

…t-failure-reporting Signed-off-by: Barak Korren <bkorren@redhat.com>

fullsend-ai-review · 2026-07-05T06:30:17Z

🤖 Finished Review · ✅ Success · Started 6:30 AM UTC · Completed 6:45 AM UTC
Commit: aa9e055 · View workflow run →

ralphbean

This is an automated comment. We are moving agent content from internal/scaffold/fullsend-repo/ to https://github.com/fullsend-ai/agents -- changes should be made to agent definitions there going forwards.

ifireball

@ralphbean

Replying to #2921 (review):

Ported to fullsend-ai/agents#38.

ifireball · 2026-07-13T07:19:44Z

Closing in favor of fullsend-ai/agents#38, which ports this work to the agents repo now that harness content lives there.

fullsend-ai-retro · 2026-07-13T07:21:56Z

🤖 Finished Retro · ✅ Success · Started 7:21 AM UTC · Completed 7:32 AM UTC
Commit: aa9e055 · View workflow run →

fullsend-ai-retro · 2026-07-13T07:32:48Z

PR #2921 added categorized post-script failure reporting for post-code.sh and post-fix.sh. The review agent caught real logic-error bugs on the first review, which the author fixed in one iteration — good code-level review quality. However, the PR was closed without merge after 11 days because a human reviewer flagged that the code targeted the deprecated internal/scaffold/fullsend-repo/ directory (the work was ported to fullsend-ai/agents#38). The successor PR then hit an undocumented runtime constraint — post-scripts cannot source sibling lib files — requiring additional rework to build a script bundling system. The Qodo review bot also caught 2 security-relevant findings the fullsend review agent missed (gitleaks output in public comments, ineffective multi-line PEM redaction).

Proposals filed:

Document post-script runtime isolation constraint in agents repo AGENTS.md
Review agent security sub-agent should detect sensitive tool output flowing into public comments

Proposals filed

Document post-script runtime isolation constraint in AGENTS.md (in fullsend-ai/agents)
Review agent should detect sensitive tool output flowing into public-facing GitHub comments (in fullsend-ai/agents)

Port fullsend-ai/fullsend#2921: add shared post-failure-report.sh with categorized failure comments, output sanitization, and workflow run links. post-code.sh posts detailed failures on the issue; post-fix.sh posts equivalent comments on the PR. Extend post-code-test.sh and post-fix-test.sh. Signed-off-by: Barak Korren <bkorren@redhat.com> Co-authored-by: Cursor <cursoragent@cursor.com>

ifireball requested a review from a team as a code owner July 2, 2026 13:26

ifireball self-assigned this Jul 2, 2026

github-actions Bot deployed to site-preview July 2, 2026 13:29 View deployment

qodo-code-review Bot reviewed Jul 2, 2026

View reviewed changes

Comment thread internal/scaffold/fullsend-repo/scripts/post-code.sh

Comment thread internal/scaffold/fullsend-repo/scripts/post-code.sh Outdated

Comment thread internal/scaffold/fullsend-repo/scripts/lib/post-failure-report.sh

This comment was marked as outdated.

Sign in to view

fullsend-ai-review Bot added component/harness Agent harness, config, and skills loading feature Feature-category issue awaiting human prioritization labels Jul 2, 2026

Merge remote-tracking branch 'upstream/main' into fix/2908-post-scrip…

da961c4

…t-failure-reporting Signed-off-by: Barak Korren <bkorren@redhat.com>

github-actions Bot deployed to site-preview July 2, 2026 13:56 View deployment

github-actions Bot deployed to site-preview July 2, 2026 14:02 View deployment

This comment was marked as outdated.

Sign in to view

fullsend-ai-review Bot added the ready-for-merge All reviewers approved — ready to merge label Jul 2, 2026

Merge remote-tracking branch 'upstream/main' into fix/2908-post-scrip…

aa9e055

…t-failure-reporting Signed-off-by: Barak Korren <bkorren@redhat.com>

github-actions Bot deployed to site-preview July 5, 2026 06:31 View deployment

fullsend-ai-review Bot approved these changes Jul 5, 2026

View reviewed changes

fullsend-ai-review Bot added ready-for-merge All reviewers approved — ready to merge and removed ready-for-merge All reviewers approved — ready to merge labels Jul 5, 2026

ifireball mentioned this pull request Jul 5, 2026

Per-repo config.yaml not read by fullsend run; workspace layout diverges from ADR 0033 #2970

Closed

fullsend-ai-triage Bot mentioned this pull request Jul 6, 2026

Post-script pre-commit tool auto-install should warn when companion scripts are not found #3070

Closed

ralphbean requested changes Jul 6, 2026

View reviewed changes

ifireball mentioned this pull request Jul 7, 2026

feat(harness): report categorized post-script failures on issue/PR fullsend-ai/agents#38

Merged

5 tasks

ifireball commented Jul 7, 2026

View reviewed changes

fullsend-ai-triage Bot mentioned this pull request Jul 8, 2026

Code agent post-script should handle missing system-level pre-commit tools gracefully instead of blocking #3746

Open

ifireball closed this Jul 13, 2026

fullsend-ai-retro Bot mentioned this pull request Jul 13, 2026

Document post-script runtime isolation constraint in AGENTS.md fullsend-ai/agents#136

Open

fullsend-ai-retro Bot mentioned this pull request Jul 13, 2026

Review agent should detect sensitive tool output flowing into public-facing GitHub comments fullsend-ai/agents#137

Open

ifireball mentioned this pull request Jul 19, 2026

harness: report push and post-script failures on issue/PR with reason #2908

Closed

github-actions Bot deleted the fix/2908-post-script-failure-reporting branch August 9, 2026 04:19

Uh oh!

Conversation

ifireball commented Jul 2, 2026

Summary

Test plan

Uh oh!

fullsend-ai-review Bot commented Jul 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

qodo-code-review Bot commented Jul 2, 2026

PR Summary by Qodo

Uh oh!

github-actions Bot commented Jul 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Site preview

Uh oh!

codecov Bot commented Jul 2, 2026

Codecov Report

Uh oh!

qodo-code-review Bot commented Jul 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Code Review by Qodo

Uh oh!

Uh oh!

Uh oh!

Uh oh!

fullsend-ai-review Bot commented Jul 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Review

Findings

High

Medium

Review

Findings

High

Medium

Uh oh!

This comment was marked as outdated.

Uh oh!

fullsend-ai-review Bot commented Jul 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

fullsend-ai-review Bot commented Jul 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

This comment was marked as outdated.

Uh oh!

fullsend-ai-review Bot commented Jul 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

ralphbean left a comment

Choose a reason for hiding this comment

Uh oh!

ifireball left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

ifireball commented Jul 13, 2026

Uh oh!

fullsend-ai-retro Bot commented Jul 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

fullsend-ai-retro Bot commented Jul 13, 2026

Proposals filed

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

fullsend-ai-review Bot commented Jul 2, 2026 •

edited

Loading

github-actions Bot commented Jul 2, 2026 •

edited

Loading

qodo-code-review Bot commented Jul 2, 2026 •

edited

Loading

fullsend-ai-review Bot commented Jul 2, 2026 •

edited

Loading

fullsend-ai-review Bot commented Jul 2, 2026 •

edited

Loading

fullsend-ai-review Bot commented Jul 2, 2026 •

edited

Loading

fullsend-ai-review Bot commented Jul 5, 2026 •

edited

Loading

ifireball left a comment •

edited

Loading

fullsend-ai-retro Bot commented Jul 13, 2026 •

edited

Loading