[dependabot]

Bumps fullsend-ai/fullsend/.github/workflows/reusable-prioritize.yml from 0.43.0 to 0.48.1.

Release notes

Sourced from fullsend-ai/fullsend/.github/workflows/reusable-prioritize.yml's releases.

v0.48.1

Highlights

Inference gateways that read the key from x-api-key. Set inference.gateway.messages_auth_header: x-api-key on an auth: api-key gateway block. Claude Code and pi then send the gateway key as x-api-key on /v1/messages requests, instead of Authorization: Bearer. Other request types keep Bearer, and the default is unchanged. An oidc block that sets it is refused. Older CLIs ignore the field silently, so upgrade every CLI that runs agents against such a gateway (#8510).

Fixes.

• A failed output extraction from the sandbox is now reported as a warning, instead of "No output files found" (#8525).
• repos install retries a preset fetch once after a network failure, names the phase that failed, and fails only the repository whose preset cannot load (#8516).
• fullsend marker syntax in agent-written sticky and status comments is escaped, so agent text cannot pose as a runner marker (#8528).
• repos install creates GitHub scaffold commits through createCommitOnBranch, so they are signed for any credential and rulesets that require signed commits accept them (#8367).

Changelog

Features

• d965f91aa6fea9fbc705d6cd9fc2593a430ce300: feat(#8370): add messages_auth_header to send the gateway key as x-api-key (@​fullsend-ai-coder[bot])

Bug Fixes

• 3918a7c6493bc02982027df6373acd0f071274d8: fix(#8367): sign GitHub scaffold commits with createCommitOnBranch (@​gwenneg)
• e97ac4f06dc8976348f1b4c5ae08ecb2c5d2900f: fix(#8438): address review feedback on PR #8482 (@​fullsend-ai-coder[bot])
• 0ce438c3376eee4261de924c9ccfff3565006a2a: fix(#8516): retry preset fetch once and fail unloadable presets per repo (@​fullsend-ai-coder[bot])
• cca8bf2182e3bb2b4797dc50517e13b991059411: fix(#8525): report failed output extraction instead of no output (@​fullsend-ai-coder[bot])
• f0a04b0ddd300d7ad9433261ce7e812fb32244fb: fix(#8528): escape history markers after the details blocks are cut (@​waynesun09)
• 0ae3f70922d1392dde92cb35ad77cbab92f1d9d7: fix(#8528): neutralize fullsend markers in agent comment bodies (@​fullsend-ai-coder[bot])
• f52c06c13759c702e5e7599f4209accbb75db72c: fix: address review feedback on PR #8510 (@​fullsend-ai-coder[bot])

Refactoring

• 3281a27813d036791e9a625d3066988352fb430f: refactor(#8438): add CI_JOB_TOKEN child-pipeline agent dispatch route (@​ggallen)

v0.48.1-rc.1

Changelog

Features

• d965f91aa6fea9fbc705d6cd9fc2593a430ce300: feat(#8370): add messages_auth_header to send the gateway key as x-api-key (@​fullsend-ai-coder[bot])

Bug Fixes

• e97ac4f06dc8976348f1b4c5ae08ecb2c5d2900f: fix(#8438): address review feedback on PR #8482 (@​fullsend-ai-coder[bot])
• 0ce438c3376eee4261de924c9ccfff3565006a2a: fix(#8516): retry preset fetch once and fail unloadable presets per repo (@​fullsend-ai-coder[bot])
• cca8bf2182e3bb2b4797dc50517e13b991059411: fix(#8525): report failed output extraction instead of no output (@​fullsend-ai-coder[bot])
• f0a04b0ddd300d7ad9433261ce7e812fb32244fb: fix(#8528): escape history markers after the details blocks are cut (@​waynesun09)
• 0ae3f70922d1392dde92cb35ad77cbab92f1d9d7: fix(#8528): neutralize fullsend markers in agent comment bodies (@​fullsend-ai-coder[bot])
• f52c06c13759c702e5e7599f4209accbb75db72c: fix: address review feedback on PR #8510 (@​fullsend-ai-coder[bot])

Refactoring

• 3281a27813d036791e9a625d3066988352fb430f: refactor(#8438): add CI_JOB_TOKEN child-pipeline agent dispatch route (@​ggallen)

v0.48.0

Highlights

Upgrade every CLI first. repos install, converge and uninstall now move fullsend-managed GitLab role credentials to project service accounts, and write the rotation state as version 2. Older CLIs reject version 2 in their rotation and status paths, and their provisioning and uninstall paths are not protected by it. Upgrade every CLI that runs these commands before any of them runs (#8242).

repos.yaml is now the only source of install settings. repos install no longer takes --roles, --fullsend-ref, --mint-url, --app-set, --inference-auth, --vendor, --signoff, --gitlab-url, --vertex-region or --forge, and no longer adds repositories to the manifest (#8219). Declare repositories and settings first, with the new schema-aware fullsend repos set, which replaces repos set-default (#8434). An empty value no longer deletes a key, so use --unset. Runner tags take a list. gitlab.runner_tags can only be unset; set gitlab.agent_runner_tags instead.

fullsend repos set <path> <value>
fullsend repos set --unset <path>

... (truncated)

Commits

• 0cb88dc Merge pull request #8368 from gwenneg/fix/signed-scaffold-commits
• ceb3a8b Merge pull request #8532 from fullsend-ai/agent/8528-neutralize-marker-syntax
• f0a04b0 fix(#8528): escape history markers after the details blocks are cut
• 54492dd Merge pull request #8518 from fullsend-ai/agent/8516-preset-fetch-retry
• c87fea1 test(#8528): assert the runner's marker never lands in history
• 7aefac7 Merge pull request #8526 from fullsend-ai/agent/8525-extract-output-errors
• 0ae3f70 fix(#8528): neutralize fullsend markers in agent comment bodies
• 0ce438c fix(#8516): retry preset fetch once and fail unloadable presets per repo
• aebc547 docs(sandbox): narrow the ExtractOutputFiles error contract
• cca8bf2 fix(#8525): report failed output extraction instead of no output
• Additional commits viewable in compare view

[github-actions]

Standardized Dependabot Review Summary

Evidence	Value
Dependency review conclusion	success
Risk	medium
Dependency	fullsend-ai/fullsend/.github/workflows/reusable-prioritize.yml
Version	0.48.0
Release age	114 hours
Workflow logs	View run

Eligible for automated approval pending live review-state validation

[github-actions]

Automated dependency approval after static and live review-state validation.
Dependency: fullsend-ai/fullsend/.github/workflows/reusable-prioritize.yml@0.48.0
Dependency review result: success
Dependency review conclusion: success
Risk: medium
Release age: 68 hours (minimum: 24 hours)

[yvonnedevlinrh]

LGTM

[yvonnedevlinrh]

@dependabot rebase

[github-actions]

Automated dependency approval after static and live review-state validation.
Dependency: fullsend-ai/fullsend/.github/workflows/reusable-prioritize.yml@0.48.0
Dependency review result: success
Dependency review conclusion: success
Risk: medium
Release age: 89 hours (minimum: 24 hours)

[dependabot]

The base commit for this pull request has not changed.

[github-actions]

Automated dependency approval after static and live review-state validation.
Dependency: fullsend-ai/fullsend/.github/workflows/reusable-prioritize.yml@0.48.0
Dependency review result: success
Dependency review conclusion: success
Risk: medium
Release age: 91 hours (minimum: 24 hours)

[github-actions]

Automated dependency approval after static and live review-state validation.
Dependency: fullsend-ai/fullsend/.github/workflows/reusable-prioritize.yml@0.48.0
Dependency review result: success
Dependency review conclusion: success
Risk: medium
Release age: 114 hours (minimum: 24 hours)

[yvonnedevlinrh]

LGTM