fix(fullsend): register local code/fix agent harnesses

[johnmcollier]

Description

After #3702 bumped the Fullsend reusable dispatch workflow to v0.29, unconfigured agents fall back to fullsend-ai/agents. That stock harness uses ghcr.io/fullsend-ai/fullsend-code:latest and a policy without allow_encoded_slash, so the repo-local .fullsend/customized/ RHDH image, yarn policy, and toolchain env never load.

That caused /fs-code on #3694 to report success while producing no PR: the agent timed out during yarn install (yarn: command not found, corepack EACCES under /usr, repeated registry.npmjs.org %2F denials), then the post-script exited with No changed files in agent's commit(s) — nothing to do.

This PR registers the local customized code/fix harnesses in .fullsend/config.yaml so config resolution beats the agents-repo fallback, and updates those harnesses for the current Fullsend schema while keeping the RHDH image and yarn sandbox customizations.

Changes

• add agents: entries for customized/harness/code.yaml and customized/harness/fix.yaml
• modernize local code/fix harnesses (role/slug, validation_loop.schema, forge.github) while retaining:
  • ghcr.io/redhat-developer/rhdh-fullsend-code:latest
  • custom policies with allow_encoded_slash / repo.yarnpkg.com
  • rhdh-toolchain.env + yarn-proxy.env
  • rhdh-workspace skill

Testing

• Tested locally
• Not tested locally, because this is Fullsend harness/config wiring validated against the failed ai-integrations: add AIResource spec.scope schema extension #3694 code-run artifact (fullsend-code from run 28977719758)

Checklist

• Added/updated tests if needed, or explained why not needed
• This PR is not a docs-only change
• After merge, re-run /fs-code on ai-integrations: add AIResource spec.scope schema extension #3694 and confirm the run log uses the RHDH image and does not say Fetching agent code from fullsend-ai/agents

Made with Cursor

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[rhdh-qodo-merge]

PR Summary by Qodo

Fix Fullsend: register repo-local code/fix harnesses and update schema

🐞 Bug fix ⚙️ Configuration changes 🕐 20-40 Minutes

AI Description

• Register repo-local customized code/fix harnesses to override fullsend-ai/agents fallback.
• Update harness YAMLs to the current Fullsend schema (slug, forge.github, output schemas).
• Preserve RHDH sandbox image/policies/env wiring to unblock Yarn/Corepack installs.

Diagram

graph TD
  A["Fullsend dispatch workflow"] --> B[".fullsend/config.yaml"] --> C["customized/harness (code+fix)"] --> D(["RHDH sandbox image"])
  C --> E["policies (allow_encoded_slash + yarn)"]
  C --> F["host env files (toolchain + proxy)"]
  C --> G["forge.github scripts (pre/post)"]
  subgraph Legend
    direction LR
    _wf["Workflow/logic"] ~~~ _cfg["Config file"] ~~~ _img(["Container image"])
  end

Loading

High-Level Assessment

The following are alternative approaches to this PR:

1. Pin/rollback Fullsend reusable-dispatch version

• ➕ Fastest mitigation if v0.29+ resolution behavior is undesirable
• ➕ Avoids needing to update local harness schema immediately
• ➖ Delays migration; will resurface on future bumps
• ➖ Does not make repo harness selection explicit/deterministic

2. Patch upstream `fullsend-ai/agents` harnesses to match RHDH needs

• ➕ Fixes all downstream repos relying on fallback behavior
• ➕ Reduces per-repo customization drift
• ➖ Harder to ship quickly; requires upstream coordination
• ➖ May not be acceptable for repo-specific image/policy/env requirements

3. Rely on `prepare-workspace` overlay only (no `agents:` registration)

• ➕ Fewer config changes in .fullsend/config.yaml
• ➖ Still risks resolver choosing upstream harness before overlays apply
• ➖ Less explicit; easier to regress when Fullsend resolver changes again

Recommendation: Keep the PR’s approach: explicitly registering the repo-local harnesses in .fullsend/config.yaml makes agent resolution deterministic across Fullsend versions while preserving the RHDH-specific image/policy/env setup. Consider upstreaming the encoded-slash/yarn-policy improvements separately if other repos hit the same failure mode.

Files changed (3) +68 / -21

Other (3) +68 / -21

config.yamlRegister repo-local code/fix harness sources to override upstream fallback +9/-0

Register repo-local code/fix harness sources to override upstream fallback

• Adds an 'agents:' section pointing at 'customized/harness/code.yaml' and 'customized/harness/fix.yaml'. Includes inline rationale explaining why explicit registration is needed after the v0.29+ fallback behavior change.

.fullsend/config.yaml

code.yamlModernize customized code harness for current Fullsend schema +26/-7

Modernize customized code harness for current Fullsend schema

• Updates metadata/comments and adds required schema fields like 'slug', 'validation_loop.schema', and 'forge.github' pre/post script wiring. Keeps the RHDH image/policy/env expectations and increases headroom via 'timeout_minutes: 45' and explicit output file naming.

.fullsend/customized/harness/code.yaml

fix.yamlModernize customized fix harness and forge env separation +33/-14

Modernize customized fix harness and forge env separation

• Aligns the fix harness with the updated Fullsend schema by adding 'slug', moving/clarifying 'post_script', and providing 'validation_loop.schema'. Introduces 'forge.github.env' split between runner and sandbox variables to ensure tokens/PR metadata are injected in the correct execution context.

.fullsend/customized/harness/fix.yaml

[rhdh-qodo-merge]

Code Review by Qodo

🐞 Bugs (2) 📘 Rule violations (0) 📎 Requirement gaps (0) 📜 Skill insights (0)

Context used

✅ Tickets: 🎫 ai-integrations: add AIResource spec.scope schema extension

✅ Compliance rules (platform): 11 rules

1. Forge runner env missing TARGET_BRANCH 🐞 Bug ☼ Reliability

Description

The fix harness configures scripts/pre-fix-rebase.sh as forge.github.pre_script, but the
adjacent forge.github.env.runner block does not set TARGET_BRANCH. Since the pre-script uses
${TARGET_BRANCH} under set -euo pipefail, the run can fail immediately due to an unset variable.

Code

.fullsend/customized/harness/fix.yaml[R72-83]

+forge:
+  github:
+    pre_script: scripts/pre-fix-rebase.sh
+    post_script: scripts/post-fix.sh
+    env:
+      runner:
+        PUSH_TOKEN: "${PUSH_TOKEN}"
+        PUSH_TOKEN_SOURCE: "${PUSH_TOKEN_SOURCE}"
+        REPO_FULL_NAME: "${REPO_FULL_NAME}"
+        PR_NUMBER: "${PR_NUMBER}"
+        REPO_DIR: "${GITHUB_WORKSPACE}/target-repo"
+      sandbox:

Relevance

⭐⭐⭐ High

Team previously fixed missing required runner_env vars causing harness failure; pre-fix-rebase.sh
explicitly requires TARGET_BRANCH.

PR-#3334
PR-#3448

ⓘ Recommendations generated based on similar findings in past PRs

Evidence

The fix harness explicitly wires pre-fix-rebase.sh as the forge pre_script, and that script
directly uses TARGET_BRANCH. The forge runner env block shown in the harness does not include
TARGET_BRANCH, creating a concrete missing-input path for the configured script.

.fullsend/customized/harness/fix.yaml[72-83]
.fullsend/customized/scripts/pre-fix-rebase.sh[10-23]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
The fix harness uses `scripts/pre-fix-rebase.sh` as the forge GitHub pre-script, but `forge.github.env.runner` omits `TARGET_BRANCH`. The script references `${TARGET_BRANCH}` with `set -u`, which can cause the pre-script (and therefore the whole fix run) to fail.

## Issue Context
`pre-fix-rebase.sh` does `git fetch origin "${TARGET_BRANCH}"` and computes merge-base against `origin/${TARGET_BRANCH}`. The forge runner env should include `TARGET_BRANCH` (and generally mirror the needed vars for runner-side scripts).

## Fix Focus Areas
- .fullsend/customized/harness/fix.yaml[72-83]
- .fullsend/customized/scripts/pre-fix-rebase.sh[10-23]

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

---

2. Fix slug duplicates coder 🐞 Bug ≡ Correctness

Description

.fullsend/customized/harness/fix.yaml sets slug: fullsend-ai-coder despite role: fix,
duplicating the code harness slug and risking agent selection/identity collisions. The pre-fix
rebase script also configures git user.name/email as fullsend-ai-coder[bot], compounding the
misidentification.

Code

.fullsend/customized/harness/fix.yaml[R17-18]

role: fix
+slug: fullsend-ai-coder

Relevance

⭐⭐ Medium

No prior evidence on enforcing unique harness slugs; team previously accepted coder-bot git identity
in pre-fix-rebase.sh.

PR-#3471
PR-#3448

ⓘ Recommendations generated based on similar findings in past PRs

Evidence

Both harnesses define the same slug, but with different roles, and the fix pre-script explicitly
sets the git identity to the coder bot, indicating a concrete misconfiguration rather than a
stylistic issue.

.fullsend/customized/harness/code.yaml[19-22]
.fullsend/customized/harness/fix.yaml[17-20]
.fullsend/customized/scripts/pre-fix-rebase.sh[15-19]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
The fix harness is configured with the same `slug` as the code/coder harness (`fullsend-ai-coder`) even though its role is `fix`. This can cause collisions in agent registration/selection and also results in the fix workflow using the coder bot identity in the rebase pre-script.

## Issue Context
The repo’s code harness uses `slug: fullsend-ai-coder`. The fix harness should have its own distinct slug (e.g., `fullsend-ai-fix`) and the pre-fix rebase script should not configure git identity as the coder bot.

## Fix Focus Areas
- .fullsend/customized/harness/fix.yaml[17-23]
- .fullsend/customized/harness/code.yaml[19-22]
- .fullsend/customized/scripts/pre-fix-rebase.sh[15-19]

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

---