chore: update fullsend shim workflow by fullsend-ai-fullsend[bot] · Pull Request #3 · fullsend-ai/metrics

fullsend-ai-fullsend · 2026-05-19T08:03:55Z

This PR updates the fullsend shim workflow to match the current template in the .fullsend config repo.

The shim content has drifted from the template — this brings it back in sync.

fullsend-ai-review · 2026-05-19T08:10:19Z

Review

Findings

High

[protected-path] .github/workflows/fullsend.yaml — This PR modifies a file under the .github/ protected path. The PR has no linked issue providing authorization for changes to governance/infrastructure files. Human approval is required for all protected-path changes.
Remediation: Link an authorizing issue that explains the need for this workflow change, or have a human reviewer approve directly.

Low

[yaml-formatting] .github/workflows/fullsend.yaml:1 — The added YAML document separator (---) is inconsistent with existing workflow files. The repository's other workflow file (collect.yml) and YAML files (holidays.yaml) do not use document separators. While valid YAML, this breaks the established formatting pattern in this codebase.
[unverified-template-sync] .github/workflows/fullsend.yaml — PR claims the shim "has drifted from the template" and this brings it "back in sync," but provides no reference to the canonical template or diff showing the drift. The change adds a management notice suggesting external template ownership, but the template source is not linked.

Info

[code-analysis] .github/workflows/fullsend.yaml:47 — The removal of secrets: {} from the dispatch job's reusable workflow invocation is a no-op change. In GitHub Actions, omitting the secrets key and passing secrets: {} are functionally equivalent — both forward zero secrets to the called workflow. No correctness or behavioral impact.
[comment-style] .github/workflows/fullsend.yaml:2 — The management barrier comment introduces a new comment pattern not present elsewhere in the repository. This appears to be a convention from an external template rather than an established repository pattern.
[code-style] .github/workflows/fullsend.yaml:47 — Removing secrets: {} eliminates an explicit empty-allowlist annotation. Both forms are functionally identical in GitHub Actions. The explicit form had marginal value as a documentation signal of intent, but this is a style preference, not a security concern. See also: [code-analysis] finding at this location.
[missing-authorization] .github/workflows/fullsend.yaml — No linked issue for infrastructure change. PR is bot-authored with branch fullsend/onboard, suggesting automated maintenance. No template source or verification mechanism is visible in this PR context.
[scope-tier-match] .github/workflows/fullsend.yaml — Change is appropriately labeled as chore: and the scope matches — only template synchronization comments and removal of a redundant line. No feature work, no scope creep.

Previous run

Review

Findings

High

[protected-path] .github/workflows/fullsend.yaml — This PR modifies a file under the .github/ protected path. The PR has no linked issue providing authorization for changes to governance/infrastructure files. Human approval is required for all protected-path changes.
Remediation: Link an authorizing issue that explains the need for this workflow change, or have a human reviewer approve directly.

Info

[code-analysis] .github/workflows/fullsend.yaml:47 — The removal of secrets: {} from the dispatch job's reusable workflow invocation is a no-op change. In GitHub Actions, omitting the secrets key and passing secrets: {} are functionally equivalent — both forward zero secrets to the called workflow. The workflow header comment confirms agents use OIDC tokens, not forwarded secrets. No correctness or behavioral impact.
[code-style] .github/workflows/fullsend.yaml:47 — Removing secrets: {} eliminates an explicit empty-allowlist annotation. Both forms (omitted vs. secrets: {}) are functionally identical in GitHub Actions — no secrets are forwarded unless secrets: inherit is used. The explicit form had marginal value as a documentation signal of intent, but this is a style preference, not a security concern.

Previous run (2)

Review

Findings

High

[protected-path] .github/workflows/fullsend.yaml — This PR modifies a file under the .github/ protected path. The PR has no linked issue providing authorization for changes to governance/infrastructure files. Human approval is required for all protected-path changes.
Remediation: Link an authorizing issue that explains the need for this workflow change, or have a human reviewer approve directly.

Info

[code-analysis] .github/workflows/fullsend.yaml:47 — The removal of secrets: {} from the dispatch job's reusable workflow invocation is a no-op change. In GitHub Actions, omitting the secrets key and passing secrets: {} are functionally equivalent — both forward zero secrets to the called workflow. The workflow header comment confirms agents use OIDC tokens, not forwarded secrets. No correctness, security, or behavioral impact.

Previous run (3)

Review

Findings

High

[protected-path] .github/workflows/fullsend.yaml — This PR modifies a file under the .github/ protected path. The PR has no linked issue providing authorization for changes to governance/infrastructure files. Human approval is required for all protected-path changes.
Remediation: Link an authorizing issue that explains the need for this workflow change, or have a human reviewer approve directly.

Info

[code-analysis] .github/workflows/fullsend.yaml:47 — The removal of secrets: {} from the dispatch job's reusable workflow invocation is a no-op change. In GitHub Actions, omitting the secrets key and passing secrets: {} are functionally equivalent — both forward zero secrets to the called workflow. The workflow header comment confirms agents use OIDC tokens, not forwarded secrets. No correctness, security, or behavioral impact.

Previous run (4)

Review — approve

Outcome: approve

Summary

Re-review of the same logical change (prior review at 1cfd588b, provenance: app-verified). The PR removes the explicit secrets: {} line from the dispatch job's reusable workflow invocation in .github/workflows/fullsend.yaml. In GitHub Actions, omitting the secrets key and passing secrets: {} are functionally equivalent — both result in no secrets being forwarded to the called reusable workflow. The workflow header comment confirms: "No secrets are needed in the enrolled repo — agents fetch scoped tokens from the centralized token mint using GitHub OIDC."

The change is a 1-line deletion that syncs the shim with the upstream template. No behavioral change, no security impact, no documentation staleness.

Dimensions

Dimension	Result
Correctness	✅ No behavioral change — `secrets: {}` and omitting `secrets` both forward zero secrets
Intent alignment	✅ Scoped to template sync as described
Platform security	✅ No secrets exposure change; OIDC token flow unaffected
Content security	✅ N/A — no user content handling
Injection defense	✅ No suspicious patterns in PR body or diff
Style/conventions	✅ Consistent with workflow conventions
Documentation currency	✅ No in-repo docs reference the `secrets` key in the dispatch job

Protected paths detected — this PR modifies files under one or more
protected paths. The review agent cannot approve PRs that touch these paths.
A human reviewer must approve this PR.

Protected files in this PR:

.github/workflows/fullsend.yaml

Previous run (5)

Review — approve

Outcome: approve

Summary

Re-review of the same logical change (prior review at e096e666, provenance: app-verified). The PR removes the explicit secrets: {} line from the dispatch job's workflow_call invocation in .github/workflows/fullsend.yaml. In GitHub Actions, omitting the secrets key and passing an empty secrets: {} are functionally equivalent — both result in no secrets being forwarded to the called reusable workflow. The workflow's own header comment confirms "No secrets are needed in the enrolled repo."

The change is a 1-line deletion that syncs the shim with the upstream template. No behavioral change, no security impact, no documentation staleness.

Dimensions

Dimension	Result
Correctness	✅ No behavioral change — both forms pass zero secrets
Intent alignment	✅ Scoped to template sync as described
Platform security	✅ No secrets exposure change
Content security	✅ N/A — no user content handling
Injection defense	✅ No suspicious patterns in PR content
Style/conventions	✅ Consistent with workflow conventions
Documentation currency	✅ No docs reference this line

Protected paths detected — this PR modifies files under one or more
protected paths. The review agent cannot approve PRs that touch these paths.
A human reviewer must approve this PR.

Protected files in this PR:

.github/workflows/fullsend.yaml

Previous run (6)

Review — approve

Outcome: approve

Summary

Re-review of the same logical change (prior review at 8a0f1126, provenance: app-verified). The PR removes the explicit secrets: {} line from the dispatch job's workflow_call invocation in .github/workflows/fullsend.yaml. In GitHub Actions, omitting the secrets key and passing an empty secrets: {} are functionally equivalent — both result in no secrets being forwarded to the called reusable workflow. The workflow's own header comment confirms "No secrets are needed in the enrolled repo."

The change is a 1-line deletion that syncs the shim with the upstream template. No behavioral change, no security impact, no documentation staleness.

Dimensions

Dimension	Result
Correctness	✅ No behavioral change — both forms pass zero secrets
Intent alignment	✅ Scoped to template sync as described
Platform security	✅ No secrets exposure change
Content security	✅ N/A — no user content handling
Injection defense	✅ No suspicious patterns in PR content
Style/conventions	✅ Consistent with workflow conventions
Documentation currency	✅ No docs reference this line

Protected paths detected — this PR modifies files under one or more
protected paths. The review agent cannot approve PRs that touch these paths.
A human reviewer must approve this PR.

Protected files in this PR:

.github/workflows/fullsend.yaml

Previous run (7)

Review — approve

Outcome: approve

Summary

Re-review of the same logical change (prior review at a7c40afd, provenance: app-verified). The PR removes the explicit secrets: {} line from the dispatch job's workflow_call invocation in .github/workflows/fullsend.yaml. In GitHub Actions, omitting the secrets key and passing an empty secrets: {} are functionally equivalent — both result in no secrets being forwarded to the called reusable workflow. The workflow's own header comment confirms "No secrets are needed in the enrolled repo."

The change is a 1-line deletion that syncs the shim with the upstream template. No behavioral change, no security impact, no documentation staleness.

Dimensions

Dimension	Result
Correctness	✅ No behavioral change — both forms pass zero secrets
Intent alignment	✅ Scoped to template sync as described
Platform security	✅ No secrets exposure change
Content security	✅ N/A — no user content handling
Injection defense	✅ No suspicious patterns in PR content
Style/conventions	✅ Consistent with workflow conventions
Documentation currency	✅ No docs reference this line

Protected paths detected — this PR modifies files under one or more
protected paths. The review agent cannot approve PRs that touch these paths.
A human reviewer must approve this PR.

Protected files in this PR:

.github/workflows/fullsend.yaml

Previous run (8)

Review — approve

Outcome: approve

Summary

Re-review of the same logical change (prior review at 5b554814, provenance: app-verified). The PR removes the explicit secrets: {} line from the dispatch job's workflow_call invocation in .github/workflows/fullsend.yaml. In GitHub Actions, omitting the secrets key and passing an empty secrets: {} are functionally equivalent — both result in no secrets being forwarded to the called reusable workflow. The workflow's own header comment confirms "No secrets are needed in the enrolled repo."

The change is a 1-line deletion that syncs the shim with the upstream template. No behavioral change, no security impact, no documentation staleness.

Dimensions

Dimension	Result
Correctness	✅ No behavioral change — both forms pass zero secrets
Intent alignment	✅ Scoped to template sync as described
Platform security	✅ No secrets exposure change
Content security	✅ N/A — no user content handling
Injection defense	✅ No suspicious patterns in PR content
Style/conventions	✅ Consistent with workflow conventions
Documentation currency	✅ No docs reference this line

Protected paths detected — this PR modifies files under one or more
protected paths. The review agent cannot approve PRs that touch these paths.
A human reviewer must approve this PR.

Protected files in this PR:

.github/workflows/fullsend.yaml

Previous run (9)

Review — approve

Outcome: approve

Summary

Re-review of the same logical change (prior review at c4135208, provenance: app-verified). The PR removes the explicit secrets: {} line from the dispatch job's workflow_call invocation in .github/workflows/fullsend.yaml. In GitHub Actions, omitting the secrets key and passing an empty secrets: {} are functionally equivalent — both result in no secrets being forwarded to the called reusable workflow. The workflow's own header comment confirms "No secrets are needed in the enrolled repo."

The change is a 1-line deletion that syncs the shim with the upstream template. No behavioral change, no security impact, no documentation staleness.

Dimensions

Dimension	Result
Correctness	✅ No behavioral change — both forms pass zero secrets
Intent alignment	✅ Scoped to template sync as described
Platform security	✅ No secrets exposure change
Content security	✅ N/A — no user content handling
Injection defense	✅ No suspicious patterns in PR content
Style/conventions	✅ Consistent with workflow conventions
Documentation currency	✅ No docs reference this line

Protected paths detected — this PR modifies files under one or more
protected paths. The review agent cannot approve PRs that touch these paths.
A human reviewer must approve this PR.

Protected files in this PR:

.github/workflows/fullsend.yaml

Previous run (10)

Review — approve

Outcome: approve

Summary

Re-review of the same logical change (prior review at c4135208, provenance: app-verified). The PR removes the explicit secrets: {} line from the dispatch job's workflow_call invocation in .github/workflows/fullsend.yaml. In GitHub Actions, omitting the secrets key and passing an empty secrets: {} are functionally equivalent — both result in no secrets being forwarded to the called reusable workflow. The workflow's own header comment confirms "No secrets are needed in the enrolled repo."

The change is a 1-line deletion that syncs the shim with the upstream template. No behavioral change, no security impact, no documentation staleness.

Dimensions

Dimension	Result
Correctness	✅ No behavioral change — both forms pass zero secrets
Intent alignment	✅ Scoped to template sync as described
Platform security	✅ No secrets exposure change
Content security	✅ N/A — no user content handling
Injection defense	✅ No suspicious patterns in PR content
Style/conventions	✅ Consistent with workflow conventions
Documentation currency	✅ No docs reference this line

Protected paths detected — this PR modifies files under one or more
protected paths. The review agent cannot approve PRs that touch these paths.
A human reviewer must approve this PR.

Protected files in this PR:

.github/workflows/fullsend.yaml

Previous run (11)

Review — approve

Outcome: approve

Summary

This PR removes the explicit secrets: {} line from the dispatch job's workflow_call invocation in .github/workflows/fullsend.yaml. In GitHub Actions, omitting the secrets key and passing an empty secrets: {} are functionally equivalent — both result in no secrets being forwarded to the called reusable workflow. The workflow's own header comment confirms "No secrets are needed in the enrolled repo."

The change is a 1-line deletion that syncs the shim with the upstream template. No behavioral change, no security impact, no documentation staleness.

Dimensions

Dimension	Result
Correctness	✅ No behavioral change — both forms pass zero secrets
Intent alignment	✅ Scoped to template sync as described
Platform security	✅ No secrets exposure change
Content security	✅ N/A — no user content handling
Injection defense	✅ No suspicious patterns in PR content
Style/conventions	✅ Consistent with workflow conventions
Documentation currency	✅ No docs reference this line

Protected paths detected — this PR modifies files under one or more
protected paths. The review agent cannot approve PRs that touch these paths.
A human reviewer must approve this PR.

Protected files in this PR:

.github/workflows/fullsend.yaml

fullsend-ai-review

See the review comment for full details.

fullsend-ai-review · 2026-05-21T12:12:04Z

    with:
      event_action: ${{ github.event.action }}
-    secrets: {}



[info] code-analysis

The removal of secrets: {} from the dispatch job reusable workflow invocation is a no-op change. In GitHub Actions, omitting the secrets key and passing secrets: {} are functionally equivalent. No correctness, security, or behavioral impact.

fullsend-ai-review

See the review comment for full details.

fullsend-ai-review · 2026-06-01T15:42:55Z

    with:
      event_action: ${{ github.event.action }}
-    secrets: {}



[info] code-analysis

The removal of secrets: {} from the dispatch job's reusable workflow invocation is a no-op change. In GitHub Actions, omitting the secrets key and passing secrets: {} are functionally equivalent — both forward zero secrets to the called workflow. The workflow header comment confirms agents use OIDC tokens, not forwarded secrets. No correctness, security, or behavioral impact.

fullsend-ai-review · 2026-06-09T06:48:21Z

🤖 Finished Review · ❌ Failure · Started 6:48 AM UTC · Completed 6:48 AM UTC
Commit: 9bd7234 · View workflow run →

fullsend-ai-review · 2026-06-09T22:43:10Z

🤖 Finished Review · ✅ Success · Started 10:43 PM UTC · Completed 10:49 PM UTC
Commit: 4ed6da4 · View workflow run →

fullsend-ai-review

See the review comment for full details.

fullsend-ai-review · 2026-06-09T22:48:59Z

    with:
      event_action: ${{ github.event.action }}
-    secrets: {}



[info] code-analysis

The removal of secrets: {} from the dispatch job reusable workflow invocation is a no-op change. In GitHub Actions, omitting the secrets key and passing secrets: {} are functionally equivalent — both forward zero secrets to the called workflow. The workflow header comment confirms agents use OIDC tokens, not forwarded secrets. No correctness or behavioral impact.

fullsend-ai-review · 2026-06-09T22:48:59Z

    with:
      event_action: ${{ github.event.action }}
-    secrets: {}



[info] code-style

Removing secrets: {} eliminates an explicit empty-allowlist annotation. Both forms are functionally identical in GitHub Actions — no secrets are forwarded unless secrets: inherit is used. The explicit form had marginal value as a documentation signal of intent, but this is a style preference, not a security concern.

Update the shim workflow to match the current template in the .fullsend config repo.

fullsend-ai-review · 2026-06-10T18:01:03Z

🤖 Finished Review · ✅ Success · Started 6:01 PM UTC · Completed 6:09 PM UTC
Commit: 900cdad · View workflow run →

fullsend-ai-review

See the review comment for full details.

fullsend-ai-review · 2026-06-10T18:09:19Z

@@ -1,3 +1,5 @@
+---


[low] yaml-formatting

The added YAML document separator (---) is inconsistent with existing workflow files in the repository. collect.yml and holidays.yaml do not use document separators.

fullsend-ai-review · 2026-06-10T18:09:19Z

@@ -44,7 +46,6 @@ jobs:
    uses: fullsend-ai/.fullsend/.github/workflows/dispatch.yml@main
    with:


[info] code-analysis

The removal of secrets: {} is a no-op change. Both forms are functionally equivalent in GitHub Actions.

fullsend-ai-review · 2026-06-10T18:09:19Z

@@ -1,3 +1,5 @@
+---
+# --- fullsend managed below - do not edit ---


[info] comment-style

The management barrier comment introduces a new comment pattern not present elsewhere in the repository.

fullsend-ai-review · 2026-06-10T18:09:19Z

@@ -44,7 +46,6 @@ jobs:
    uses: fullsend-ai/.fullsend/.github/workflows/dispatch.yml@main
    with:


[info] code-style

Removing secrets: {} eliminates an explicit empty-allowlist annotation. This is a style preference, not a security concern.

fullsend-ai-fullsend Bot force-pushed the fullsend/onboard branch from 51dfcbf to c413520 Compare May 19, 2026 08:05

fullsend-ai-review Bot added the requires-manual-review Review requires human judgment label May 19, 2026

fullsend-ai-fullsend Bot force-pushed the fullsend/onboard branch from c413520 to 5b55481 Compare May 19, 2026 09:12

fullsend-ai-review Bot added requires-manual-review Review requires human judgment and removed requires-manual-review Review requires human judgment labels May 19, 2026

fullsend-ai-fullsend Bot force-pushed the fullsend/onboard branch from 5b55481 to a7c40af Compare May 19, 2026 10:40

fullsend-ai-review Bot added requires-manual-review Review requires human judgment and removed requires-manual-review Review requires human judgment labels May 19, 2026

fullsend-ai-fullsend Bot force-pushed the fullsend/onboard branch from a7c40af to 8a0f112 Compare May 19, 2026 12:42

fullsend-ai-review Bot added requires-manual-review Review requires human judgment and removed requires-manual-review Review requires human judgment labels May 19, 2026

fullsend-ai-fullsend Bot force-pushed the fullsend/onboard branch from 8a0f112 to e096e66 Compare May 19, 2026 14:13

fullsend-ai-review Bot added requires-manual-review Review requires human judgment and removed requires-manual-review Review requires human judgment labels May 19, 2026

fullsend-ai-fullsend Bot force-pushed the fullsend/onboard branch 2 times, most recently from 93e7415 to 1cfd588 Compare May 20, 2026 08:11

fullsend-ai-review Bot added requires-manual-review Review requires human judgment and removed requires-manual-review Review requires human judgment labels May 20, 2026

fullsend-ai-fullsend Bot force-pushed the fullsend/onboard branch from 1cfd588 to 6721ac8 Compare May 20, 2026 10:04

fullsend-ai-review Bot added requires-manual-review Review requires human judgment and removed requires-manual-review Review requires human judgment labels May 20, 2026

fullsend-ai-fullsend Bot force-pushed the fullsend/onboard branch 2 times, most recently from bdc6b08 to 9b3886d Compare May 21, 2026 12:06

fullsend-ai-review Bot suggested changes May 21, 2026

View reviewed changes

fullsend-ai-review Bot removed the requires-manual-review Review requires human judgment label May 21, 2026

fullsend-ai-fullsend Bot force-pushed the fullsend/onboard branch from 9b3886d to 047f40b Compare May 21, 2026 13:58

fullsend-ai-fullsend Bot force-pushed the fullsend/onboard branch from 047f40b to 120213d Compare June 1, 2026 15:38

fullsend-ai-review Bot suggested changes Jun 1, 2026

View reviewed changes

fullsend-ai-fullsend Bot force-pushed the fullsend/onboard branch from 120213d to 2f8ff10 Compare June 5, 2026 07:41

fullsend-ai-fullsend Bot force-pushed the fullsend/onboard branch 4 times, most recently from 00aebe0 to 2dafd1d Compare June 9, 2026 06:46

fullsend-ai-fullsend Bot force-pushed the fullsend/onboard branch from 2dafd1d to 7c6911f Compare June 9, 2026 22:41

fullsend-ai-review Bot suggested changes Jun 9, 2026

View reviewed changes

chore: update fullsend shim workflow

900cdad

Update the shim workflow to match the current template in the .fullsend config repo.

fullsend-ai-fullsend Bot force-pushed the fullsend/onboard branch from 7c6911f to 900cdad Compare June 10, 2026 17:59

fullsend-ai-review Bot suggested changes Jun 10, 2026

View reviewed changes

		@@ -44,7 +46,6 @@ jobs:
		uses: fullsend-ai/.fullsend/.github/workflows/dispatch.yml@main
		with:

		@@ -1,3 +1,5 @@
		---
		# --- fullsend managed below - do not edit ---

Conversation

fullsend-ai-fullsend Bot commented May 19, 2026

Uh oh!

fullsend-ai-review Bot commented May 19, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Review

Findings

High

Low

Info

Review

Findings

High

Info

Review

Findings

High

Info

Review

Findings

High

Info

Review — approve

Summary

Dimensions

Review — approve

Summary

Dimensions

Review — approve

Summary

Dimensions

Review — approve

Summary

Dimensions

Review — approve

Summary

Dimensions

Review — approve

Summary

Dimensions

Review — approve

Summary

Dimensions

Review — approve

Summary

Dimensions

Uh oh!

fullsend-ai-review Bot left a comment

Choose a reason for hiding this comment

Uh oh!

fullsend-ai-review Bot May 21, 2026

Choose a reason for hiding this comment

Uh oh!

fullsend-ai-review Bot left a comment

Choose a reason for hiding this comment

Uh oh!

fullsend-ai-review Bot Jun 1, 2026

Choose a reason for hiding this comment

Uh oh!

fullsend-ai-review Bot commented Jun 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

fullsend-ai-review Bot commented Jun 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

fullsend-ai-review Bot left a comment

Choose a reason for hiding this comment

Uh oh!

fullsend-ai-review Bot Jun 9, 2026

Choose a reason for hiding this comment

Uh oh!

fullsend-ai-review Bot Jun 9, 2026

Choose a reason for hiding this comment

Uh oh!

fullsend-ai-review Bot commented Jun 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

fullsend-ai-review Bot left a comment

Choose a reason for hiding this comment

Uh oh!

fullsend-ai-review Bot commented May 19, 2026 •

edited

Loading

fullsend-ai-review Bot commented Jun 9, 2026 •

edited

Loading

fullsend-ai-review Bot commented Jun 9, 2026 •

edited

Loading

fullsend-ai-review Bot commented Jun 10, 2026 •

edited

Loading