ci(test): add mint provenance repro marker by ralphbean · Pull Request #8251 · fullsend-ai/fullsend

ralphbean · 2026-10-09T12:38:44Z

Temporary harmless marker for testing mint workflow provenance. No credential handling or agent behavior changes.

Signed-off-by: Ralph Bean <rbean@redhat.com>

qodo-code-review · 2026-10-09T12:39:07Z

PR Summary by Qodo

Add a provenance reproducer marker to the dispatch workflow

⚙️ Configuration changes 🕐 Less than 5 minutes

AI Description

• Add a temporary log marker to the route job for mint provenance testing.
• Leave credential handling, routing, and agent behavior unchanged.

High-Level Assessment

A log-only step is appropriate for this temporary reproducer: it provides a recognizable marker without changing workflow logic or handling credentials.

Files changed (1) +3 / -0

Other (1) +3 / -0

reusable-dispatch.ymlEmit a provenance reproducer marker in the route job +3/-0

Emit a provenance reproducer marker in the route job
• Adds an unconditional echo step before event-action validation. The step prints 'MINT_PROVENANCE_REPRO_FOREIGN_BRANCH' for provenance testing without changing routing or agent behavior.
.github/workflows/reusable-dispatch.yml

qodo-code-review · 2026-10-09T12:39:23Z

Code Review by Qodo

🐞 Bugs (0) 📘 Rule violations (1) 🔗 Cross-repo conflicts (0) 📜 Skill insights (0)

1. Workflow change lacks required guide review 📘 Rule violation § Compliance

Description

The added provenance marker modifies a GitHub Actions workflow without recording that
docs/contributing/ci-workflows.md was consulted. Because this workflow runs in the dispatch path
and declares secret inputs while supporting pull-request contexts, the missing review evidence
affects the workflow change as a whole.

Code

.github/workflows/reusable-dispatch.yml[R117-118]

+      - name: Mint provenance reproducer marker
+        run: echo "MINT_PROVENANCE_REPRO_FOREIGN_BRANCH"

Relevance

● Weak
Recent matching workflow-guide compliance finding was rejected for a similar pull_request_target
workflow change.
PR-#7845

ⓘ Recommendations generated based on similar findings in past PRs

Evidence
The changed workflow adds a new step at the cited lines, while the workflow declares secret inputs
and contains pull-request-target handling. The PR description only describes a temporary marker and
does not state that docs/contributing/ci-workflows.md was consulted.
Rule 3201588: Consult CI workflow guide when modifying GitHub Actions workflows or secrets
.github/workflows/reusable-dispatch.yml[117-118]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
The workflow was modified without explicit evidence that `docs/contributing/ci-workflows.md` was consulted, as required for workflow changes involving dispatch and secret-handling contexts.

## Fix Focus Areas
- .github/workflows/reusable-dispatch.yml[117-118]

## Recommended Fix
Add an explicit statement to the PR description or an appropriate inline comment confirming that `docs/contributing/ci-workflows.md` was reviewed and that the workflow change follows its documented conventions.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

Dismiss ↗ | View ↗

Context sources

✅ Compliance rules (platform): 89 rules

✅ Skills: 5 invoked

writing-user-docs

writing-adrs

check-patch-coverage

cutting-releases

adr-corner

✅ Cross-repo context — repo relationships

Explored: repo: fullsend-ai/experiments (sha: 3f1614fa) — View relationship

Explored: repo: fullsend-ai/.fullsend (sha: 7c163cad) — View relationship

Explored: repo: fullsend-ai/metrics (sha: aceacd33) — View relationship

Explored: repo: fullsend-ai/pi-xai-vertex (sha: 8f50bdda) — View relationship

Explored: repo: fullsend-ai/scribe (sha: 0f3eb528) — View relationship

Explored: repo: fullsend-ai/agents (sha: f3dd8897) — View relationship

Explored: repo: fullsend-ai/pi-anthropic-vertex (sha: 960eff35) — View relationship

Explored: repo: fullsend-ai/mlflow-assessments (sha: 2fdb0120) — View relationship

Review mode: Auto: 🚀 Fast: Localized harmless CI marker with no credentials or behavior changes.

Tip of the day

💡 Did you know, you can show, collapse, or hide each part of a finding: code, evidence, and all

More tips ↗ | Customize Qodo ↗ | Qodo docs ↗

fullsend-ai-review · 2026-10-09T12:40:43Z

🤖 Finished Review · ✅ Success · Started 12:40 PM UTC · Completed 12:50 PM UTC

Commit: 7bd8e73 · View workflow run →

Runtime: pi · Model: sonnet → claude-sonnet-5-5 · Effort: high · Cost: $1.28

codecov · 2026-10-09T12:45:40Z

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

fullsend-ai-review · 2026-10-09T12:50:33Z

Risk Assessment: elevated (3/5)

Details

Protected CI workflow modification with no accompanying tests on a high-churn, regression-prone dispatch workflow with extensive author contention, elevated despite minimal diff size and established author.

fullsend-ai-review · 2026-10-09T12:50:36Z

Review

Findings

High

[protected-path] .github/workflows/reusable-dispatch.yml:117 — The PR modifies a protected path (.github/workflows/reusable-dispatch.yml) and has no linked issue; the description only calls the change a temporary test marker and does not justify modifying governance/infrastructure files. Human approval is always required for protected-path changes.

Medium

[intent-alignment] .github/workflows/reusable-dispatch.yml:117 — The PR says it is a temporary reproducer marker for testing mint workflow provenance. It adds a debug step to the core production reusable dispatch workflow. That workflow is shared by downstream callers, so if the PR merges, the step runs on every Route job invocation. A transient test step does not belong permanently in this workflow.
Remediation: If the PR exists only to test CI or reproduce provenance behavior on a branch, convert it to draft or close it once verification is done, so the temporary marker never reaches main. If permanent provenance verification is needed in reusable-dispatch.yml, define that requirement and add permanent instrumentation for it.

Next steps:

/fs-fix — agent addresses review findings automatically
/fs-fix <your instruction> — agent fixes with your specific guidance
Push commits directly — review re-runs automatically on push
/fs-fix-stop — disable automatic fix runs for this PR

fullsend-ai-review

See the review comment for full details.

fullsend-ai-review · 2026-10-09T12:50:38Z

      trigger_source: ${{ steps.route.outputs.trigger_source }}
      event_payload: ${{ steps.payload.outputs.event_payload }}
    steps:
+      - name: Mint provenance reproducer marker


[high] protected-path

The PR modifies a protected path (.github/workflows/reusable-dispatch.yml) and has no linked issue; the description only calls the change a temporary test marker and does not justify modifying governance/infrastructure files. Human approval is always required for protected-path changes.

fullsend-ai-review · 2026-10-09T12:50:38Z

      trigger_source: ${{ steps.route.outputs.trigger_source }}
      event_payload: ${{ steps.payload.outputs.event_payload }}
    steps:
+      - name: Mint provenance reproducer marker


[medium] intent-alignment

The PR says it is a temporary reproducer marker for testing mint workflow provenance. It adds a debug step to the core production reusable dispatch workflow. That workflow is shared by downstream callers, so if the PR merges, the step runs on every Route job invocation. A transient test step does not belong permanently in this workflow.

Suggested fix: If the PR exists only to test CI or reproduce provenance behavior on a branch, convert it to draft or close it once verification is done, so the temporary marker never reaches main. If permanent provenance verification is needed in reusable-dispatch.yml, define that requirement and add permanent instrumentation for it.

ci(test): add mint provenance repro marker

7bd8e73

Signed-off-by: Ralph Bean <rbean@redhat.com>

ralphbean requested a review from a team as a code owner October 9, 2026 12:38

ralphbean temporarily deployed to dev October 9, 2026 12:38 — with GitHub Actions Inactive

fullsend-ai-review Bot added the risk/elevated PR risk: elevated label Oct 9, 2026

fullsend-ai-review Bot suggested changes Oct 9, 2026

View reviewed changes

ralphbean closed this Oct 9, 2026

Navigation Menu

Repository navigation

ci(test): add mint provenance repro marker - #8251

ci(test): add mint provenance repro marker#8251
ralphbean wants to merge 1 commit into
fullsend-ai:mainfrom
ralphbean:foreign-branch

ralphbean commented Oct 9, 2026

Uh oh!

qodo-code-review Bot commented Oct 9, 2026

Uh oh!

qodo-code-review Bot commented Oct 9, 2026

Uh oh!

fullsend-ai-review Bot commented Oct 9, 2026 •

edited

Loading

Uh oh!

codecov Bot commented Oct 9, 2026

Uh oh!

fullsend-ai-review Bot commented Oct 9, 2026

Uh oh!

fullsend-ai-review Bot commented Oct 9, 2026

Uh oh!

fullsend-ai-review Bot left a comment

Uh oh!

fullsend-ai-review Bot Oct 9, 2026

Uh oh!

fullsend-ai-review Bot Oct 9, 2026

Uh oh!

This branch was previously deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

ralphbean commented Oct 9, 2026

Uh oh!

qodo-code-review Bot commented Oct 9, 2026

PR Summary by Qodo

Uh oh!

qodo-code-review Bot commented Oct 9, 2026

Code Review by Qodo

Uh oh!

fullsend-ai-review Bot commented Oct 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

codecov Bot commented Oct 9, 2026

Codecov Report

Uh oh!

fullsend-ai-review Bot commented Oct 9, 2026

Uh oh!

fullsend-ai-review Bot commented Oct 9, 2026

Review

Findings

High

Medium

Uh oh!

fullsend-ai-review Bot left a comment

Choose a reason for hiding this comment

Uh oh!

fullsend-ai-review Bot Oct 9, 2026

Choose a reason for hiding this comment

Uh oh!

fullsend-ai-review Bot Oct 9, 2026

Choose a reason for hiding this comment

Uh oh!

This branch was previously deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

fullsend-ai-review Bot commented Oct 9, 2026 •

edited

Loading