[Benkapner]

Summary

Skip the dispatch and stop-fix jobs in the per-repo shim when the FULLSEND_MINT_URL repository variable is unset. GitHub doesn't copy repo variables to forks, so forks of enrolled repos no longer start agent runs. Quiet skip: no extra job, no failed run, no notice.

Why a variable check and not the repo name

The issue suggested baking the repo name into the workflow. A variable check gets the same result with nothing repo-specific in the file, so re-onboarding a fork just works and a rename or transfer doesn't silently turn Fullsend off. The CLI already uses FULLSEND_MINT_URL as the "installed" marker.

Notes

• Enrolled repos already have the variable, so nothing changes for them. Existing installs pick this up on the next scaffold sync.
• Known gap: if FULLSEND_MINT_URL is set as an org-level variable, a fork inside that same org would still see it and run.
• GitLab is out of scope.

Closes #7895

[github-actions]

E2E tests did not run

E2E tests run automatically for org/repo members and collaborators on pull requests.

For other contributors, a maintainer with write access must add the ok-to-test label after the latest push.

See E2E testing guide for details.

[github-actions]

E2E tests did not run

E2E tests run automatically for org/repo members and collaborators on pull requests.

For other contributors, a maintainer with write access must add the ok-to-test label after the latest push.

See E2E testing guide for details.

[qodo-code-review]

PR Summary by Qodo

Skip Fullsend jobs in unenrolled repository forks

🐞 Bug fix 🧪 Tests 🕐 Less than 10 minutes

AI Description

• Skip per-repo dispatch and stop-fix jobs when the mint URL variable is unset, preventing forked
 workflows from starting agents.
• Add a template test that checks both jobs retain the enrollment gate.

Diagram

graph TD
  A["GitHub event"] --> B{"Mint URL set?"} -->|yes| C{"Job conditions match?"} -->|dispatch| D["Dispatch job"]
  B -->|no| E["Skip both jobs"]
  C -->|stop-fix| F["Stop-fix job"]

Loading

High-Level Assessment

The following are alternative approaches to this PR:

1. Gate on repository identity

• ➕ Could distinguish a fork even when it can access an org-level mint URL variable.
• ➖ Embeds repository-specific identity in the template.
• ➖ Renames, transfers, and re-onboarding would require workflow changes.

Recommendation: Keep the variable gate: it uses the existing enrollment marker and lets a re-onboarded fork run without changing its workflow. The known exception is a fork that can access an org-level FULLSEND_MINT_URL; this gate does not distinguish that fork from an enrolled repository.

Files changed (2) +30 / -2

Bug fix (1) +7 / -2

shim-per-repo.yamlGate per-repo agent jobs on the mint URL variable +7/-2

Gate per-repo agent jobs on the mint URL variable

• Adds the same nonempty FULLSEND_MINT_URL check to dispatch and stop-fix job conditions. Forks without the variable skip both jobs while existing event filters remain in place.

internal/scaffold/fullsend-repo/templates/shim-per-repo.yaml

Tests (1) +23 / -0

scaffold_test.goVerify both shim jobs include the enrollment gate +23/-0

Verify both shim jobs include the enrollment gate

• Parses the per-repo workflow template and asserts that dispatch and stop-fix each have a condition containing the mint URL gate.

internal/scaffold/scaffold_test.go

[qodo-code-review]

Code Review by Qodo

🐞 Bugs (0) 📘 Rule violations (1) 🔗 Cross-repo conflicts (0) 📜 Skill insights (0)

1. Fork skip behavior lacks operator guidance 📘 Rule violation ⚙ Maintainability

Description

dispatch and stop-fix now require vars.FULLSEND_MINT_URL, but the PR does not update the
repository-variable guidance required by docs/contributing/documentation.md. When that variable is
absent, both jobs skip silently, while the existing operations guide does not explain that the
variable now controls whether they run.

Code

internal/scaffold/fullsend-repo/templates/shim-per-repo.yaml[38]

+      vars.FULLSEND_MINT_URL != ''

Relevance

●●● Strong

Recent precedents accept operator documentation clarifying workflow gates, variable behavior, and
operational consequences.

PR-#7817
PR-#7713
PR-#7945

ⓘ Recommendations generated based on similar findings in past PRs

Evidence

The changed workflow conditions make the repository variable a gate for both jobs. The documentation
guide directs authors changing repository-variable behavior to check the operations guide and
feature documentation, but the cited operations passage discusses the variable only as part of
teardown and does not describe the new gate.

Rule 2806787: Update CLI-related docs according to docs/contributing/documentation.md when changing CLI surface
internal/scaffold/fullsend-repo/templates/shim-per-repo.yaml[34-39]
internal/scaffold/fullsend-repo/templates/shim-per-repo.yaml[70-75]
docs/contributing/documentation.md[7-38]
docs/guides/getting-started/operations.md[100-106]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
The per-repo workflow now skips both agent jobs when the mint URL repository variable is absent, but the operations guidance does not describe this behavior.

## Fix Focus Areas
- internal/scaffold/fullsend-repo/templates/shim-per-repo.yaml[34-39]
- internal/scaffold/fullsend-repo/templates/shim-per-repo.yaml[70-74]
- docs/guides/getting-started/operations.md[80-106]

## Recommended Fix
Update the relevant operations guidance to explain that an unset repository-level FULLSEND_MINT_URL silently skips both jobs, and clarify the documented org-level variable exception.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

Dismiss ↗ | View ↗

---

Context sources

✅ Compliance rules (platform): 96 rules

✅ Skills: 5 invoked

  writing-user-docs

  writing-adrs

  check-patch-coverage

  cutting-releases

  adr-corner

✅ Cross-repo context — repo relationships

  Explored: repo: fullsend-ai/experiments (sha: 3f1614fa) — View relationship

  Explored: repo: fullsend-ai/.fullsend (sha: 7c163cad) — View relationship

  Explored: repo: fullsend-ai/pi-xai-vertex (sha: 8f50bdda) — View relationship

  Explored: repo: fullsend-ai/scribe (sha: 0f3eb528) — View relationship

  Explored: repo: fullsend-ai/mlflow-assessments (sha: 46f42987) — View relationship

  Explored: repo: fullsend-ai/pi-anthropic-vertex (sha: 960eff35) — View relationship

  Explored: repo: fullsend-ai/metrics (sha: 43e2ec66) — View relationship

  Explored: repo: fullsend-ai/agents (sha: 0cc4bf8e) — View relationship

Review mode: Auto: ⚖️ Balanced: This changes GitHub Actions job gating in a repository scaffold and affects fork/enrollment behavior, so a complete review is warranted despite the localized diff.

Tip of the day

💡 Did you know, you can turn on the rule miner and Qodo learns your standards from review history

More tips ↗ | Customize Qodo ↗ | Qodo docs ↗

[qodo-code-review]

1. Fork skip behavior lacks operator guidance 📘 Rule violation ⚙ Maintainability

dispatch and stop-fix now require vars.FULLSEND_MINT_URL, but the PR does not update the
repository-variable guidance required by docs/contributing/documentation.md. When that variable is
absent, both jobs skip silently, while the existing operations guide does not explain that the
variable now controls whether they run.

Agent Prompt

## Issue description
The per-repo workflow now skips both agent jobs when the mint URL repository variable is absent, but the operations guidance does not describe this behavior.

## Fix Focus Areas
- internal/scaffold/fullsend-repo/templates/shim-per-repo.yaml[34-39]
- internal/scaffold/fullsend-repo/templates/shim-per-repo.yaml[70-74]
- docs/guides/getting-started/operations.md[80-106]

## Recommended Fix
Update the relevant operations guidance to explain that an unset repository-level FULLSEND_MINT_URL silently skips both jobs, and clarify the documented org-level variable exception.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

Dismiss ↗ | View ↗

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[waynesun09]

Closing this one. Thanks for the work, @Benkapner. The trade-off doesn't pay off:

• The problem is narrow. Forks start with Actions disabled, and the shim has no push trigger. It only runs in a fork whose owner enabled Actions and that gets its own issues, PRs or comments. Even then it fails before minting a token, with a self-explaining FULLSEND_MINT_URL is not set.
• The gate depends on a variable we plan to drop. FULLSEND_MINT_URL is written as a repo variable only for backward compatibility. chore(install): migrate existing installs from repo vars/secrets to config (ADR 0069, optional) #4977 moves it to config, and at that point this check would silently skip every install.
• Silent beats an error only in forks. In an enrolled repo whose variable gets deleted, a red run becomes no run at all, which is harder to notice.
• The org-variable gap noted in the PR doesn't matter now that per-org mode is deprecated.

@rh-hemartin, suggest closing #7895 as not planned unless a real fork report comes in. If we do want the re-onboard message, a gate on github.repository_id, rendered at install, plus a small notice job would hold up through renames and transfers without depending on a repo variable.

[rh-hemartin]

No problem by me, I didn't know that forks have their Actions disabled. So this case covers someone that knows what they are doing because they enabled the Actions, so they should be aware of the consequences. Makes sense to me.