[dependabot]

Bumps fullsend-ai/fullsend/.github/workflows/reusable-prioritize.yml from 0.43.0 to 0.47.0.

Release notes

Sourced from fullsend-ai/fullsend/.github/workflows/reusable-prioritize.yml's releases.

v0.47.0

Highlights

The new inference gateway route lets agents reach their models through an inference gateway that you run. The gateway trusts the forge's OIDC token directly and holds the upstream provider credential, so the forge stores no provider key (#8284, #8287, #8293, #8297). You add one inference.gateway block per repository to .fullsend/config.yaml, with url set to the gateway's bare origin. An agent picks the route by giving its model a gateway/ prefix, and every other provider keeps its own route. The route works on pi, Codex (#8309) and Claude Code (#8310). Claude Code also recovers when a single tool call outlasts the gateway token: the stale request gets a 401 from the gateway, and Claude Code fetches the current credential and continues. For this, the gateway must reject an expired token with 401 or 403, not a 5xx (#8321). auth: oidc is the default and the recommended mode. auth: api-key reads FULLSEND_INFERENCE_GATEWAY_API_KEY and also applies to local runs. It is supported, but use it with caution because it relies on a long-lived secret (#8300). There is no fallback between the two modes. Set the block with fullsend github setup --inference-gateway-url/-audience/-auth/-model, and check it with fullsend inference gateway status. The new operator guide and the owner walkthrough in "Getting inference" cover both sides (#8315). The sandbox image includes pi-inference-gateway v0.1.2 (#8302) and Claude Code v2.1.296 (#8292).

inference:
  gateway:
    url: https://gateway.example.com   # bare origin, https
    audience: fullsend-inference       # omit with auth: api-key
    # auth: api-key                    # default is oidc
    models:                            # needed for pi only
      claude-sonnet-4-6:
        api: anthropic-messages

An agent whose model is gateway/claude-sonnet-4-6 then runs through the gateway.

Known limits: Codex speaks only the Responses API; some gateways need a request transform for some models; token counts can read 0 when the gateway sends usage after the finish chunk; and GitLab is not on the route yet.

fullsend repos install and fullsend repos status now manage both .fullsend/config.yaml and .fullsend/config.base.yaml for every repository in the manifest, even when repos.yaml has no config or config_base key. This is a breaking change (#8263). If a repository's existing config.yaml lacks the ownership marker, for example because it was first set up with fullsend github setup, adopt it. Move the settings you want to keep into repos.yaml (config, runtime, allowed_remote_resources), then replace or remove the old file so the managed one can be written. An existing config.base.yaml with no matching config_base preset blocks install until you declare the preset or remove the file. A read-only manifest, such as one fetched over HTTPS, must already contain the first-install values. New setups also list only fullsend-ai/fullsend under create_issues.allow_targets.repos, and the repository the agent runs in stays allowed implicitly.

Release images are now built natively for each platform and no longer pull anything from Docker Hub, so a Docker Hub rate limit can no longer block an image publish (#8318).

---

Changelog

Features

• 6de44ac8daa4b893036d6185e7285680eafa8c53: feat(#8218)!: manage both config files by default in repos install and status (@​fullsend-ai-coder[bot])
• 53c2c28591688a2032f4d9d7a5c98b9c07d4409d: feat(#8280): add api-key auth mode to the inference gateway route (@​fullsend-ai-coder[bot])
• 53cc36b060ee24af7baf420ba16d72c091cc291f: feat(#8280): add gateway status command and runner route parts (@​fullsend-ai-coder[bot])
• 749cdfdb5a9fefa6ff7ecb898eff16060c0ed422: feat(#8280): add inference.gateway config block and setup flags (@​fullsend-ai-coder[bot])
• 3fd7aa7bcacb8510a3fd173e5c851a34a802344b: feat(#8280): pass the inference gateway API key to the runner (@​waynesun09)
• 9c80ab9b71692b4570b5305e1cde579d6600dd16: feat(#8280): wire the inference gateway route into fullsend run (@​fullsend-ai-coder[bot])
• 0c241c25c08bb85c645ecc00bebb90d58068b358: feat(#8294): run Claude Code on the inference gateway route for gateway/ models (@​fullsend-ai-coder[bot])
• a043ccf69f40456d4a3c344875348401ecfbb038: feat(#8295): route codex gateway/ models through a runner-owned provider (@​fullsend-ai-coder[bot])

Bug Fixes

• 906191f51abc10b7f9954ce2dd9e947113e72b80: fix(#8218): address review feedback on PR #8263 (@​fullsend-ai-coder[bot])
• 687809e6690611a31db1c00c8f357be40a69977b: fix(#8218): require local declaration when a gateway is first introduced (@​fullsend-ai-coder[bot])
• 7b0e9a8ad38717892997f8a37a84a67bb13512f1: fix(#8237): address review feedback on PR #8269 (@​fullsend-ai-coder[bot])
• d632a7ae5e6cd568c9354285a8d44976a3e9938d: fix(#8237): address review feedback on PR #8269 (@​fullsend-ai-coder[bot])
• bb371d0957001eecca0126377e200d42bfa2eeaa: fix(#8237): address review feedback on PR #8269 (@​fullsend-ai-coder[bot])
• 2fe1c67963064b0db95e791592b48e0649dcb750: fix(#8239): keep trigger-create failure class in quarantine, document uninstall retention (@​fullsend-ai-coder[bot])
• aafcea0a5d26a4216e35af00d6988a11ef42b8fb: fix(#8239): scope generation state to wildcard variables, align docs (@​fullsend-ai-coder[bot])
• cb256689c6bc919caae58f5f5f5576d532f5911b: fix(#8240): keep supplied Poller attribution failures unresolved (@​fullsend-ai-coder[bot])
• 73b5d81da83df18c7f14e0477cc8af219ae507df: fix(#8240): reject malformed GitLab trigger inventories (@​fullsend-ai-coder[bot])
• 29c0d38f85225b8cc457bb08ae72cba732fb6d97: fix(#8280): address review feedback on PR #8300 (@​fullsend-ai-coder[bot])
• ca6bb0f2daf413f4c4f019b32f7d65bb6c05eaad: fix(#8280): bound gateway hand-off retries and seed the newest generation (@​waynesun09)
• 05574abfe4765af27fdcef47513938bc0b8b91af: fix(#8280): check gateway model overrides against the extension's shapes (@​waynesun09)
• 5dda6ac01f6f371988f2090282c8292d5c06fb03: fix(#8280): collect logs and hold re-seeds until every preflight passes (@​waynesun09)

... (truncated)

Commits

• 64b1f98 Merge pull request #8321 from fullsend-ai/agent/8316-claude-gateway-stale-helper
• 6de7f8e docs(#8316): state the 401/403 requirement and the gateway leeway
• 25f5b83 fix(#8316): recover Claude Code from a stale gateway placeholder
• 96ef3c6 Merge pull request #8318 from fullsend-ai/fullsend-8289-native-arm
• 1a53813 ci(#8289): build image arm64 legs on native runners, drop QEMU
• bd7a767 Merge pull request #8310 from fullsend-ai/agent/8294-claude-gateway-route
• c0b5e5f docs(#8294): correct the hand-off margin and an anchor on the Claude Code page
• c07643c docs(#8294): list Claude Code and codex in the gateway prerequisites
• fa7aa8f docs(#8294): name every gateway runtime in the operator guide
• 7e98a23 chore(#8294): merge main after the codex gateway route (#8309)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[github-actions]

Automated dependency approval after static and live review-state validation.
Dependency: fullsend-ai/fullsend/.github/workflows/reusable-prioritize.yml@0.47.0
Dependency review result: success
Dependency review conclusion: success
Risk: medium
Release age: 67 hours (minimum: 24 hours)

[github-actions]

Standardized Dependabot Review Summary

Evidence	Value
Dependency review conclusion	success
Risk	medium
Dependency	fullsend-ai/fullsend/.github/workflows/reusable-prioritize.yml
Version	0.47.0
Release age	67 hours
Workflow logs	View run

Eligible for automated approval pending live review-state validation

[dependabot]

Superseded by #139.