chore: update fullsend shim workflow

[fullsend-ai-fullsend]

This PR updates the fullsend shim workflow to match the current template in the .fullsend config repo.

The shim content has drifted from the template — this brings it back in sync.

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 8:56 PM UTC · Completed 9:02 PM UTC
Commit: 14477fe · View workflow run →

[fullsend-ai-review]

Review

Findings

Critical

• [permission-expansion] .github/workflows/fullsend.yaml:44 — The reusable workflow reference is changed from a pinned commit SHA (@701e62a9c6f104ed68f8d4085d9c3b8bad3a82e4) to a mutable branch (@main). This is a supply-chain security regression. Anyone with write access to konflux-ci/.fullsend can modify dispatch.yml on main, and this workflow will immediately execute the modified code. The dispatch job inherits top-level permissions including actions: write and id-token: write, enabling OIDC token minting. The workflow triggers on pull_request_target (access to secrets) and issue_comment (triggerable by external users).
  Remediation: Keep the SHA-pinned reference. If the upstream workflow has legitimately changed, verify the new commit, audit the diff from the old SHA, and pin to the new verified SHA.

High

• [protected-path] .github/workflows/fullsend.yaml — This PR modifies a file under the protected .github/ path. The PR has no linked issue and does not explain why changes to governance/infrastructure files are necessary beyond "sync with template." Human approval is always required for protected-path changes.

Medium

• [yaml-key-quoting] .github/workflows/fullsend.yaml:26 — The trigger key uses unquoted on: while all other workflow files in this repository consistently use the quoted form "on":. This creates a style inconsistency. yamllint's truthy rule may also flag bare on as a boolean value under YAML 1.1.
  Remediation: Change on: back to "on": to match the established pattern.

• [missing-authorization] No linked issue for a security-sensitive change. The PR unpins a reusable workflow reference holding id-token: write and actions: write permissions. The bot-submitted PR provides no security justification.
  Remediation: Create an issue documenting the intent and including security review of the unpinning change.

---

Next steps:

• /fs-fix — agent addresses review findings automatically
• /fs-fix <your instruction> — agent fixes with your specific guidance
• Push commits directly — review re-runs automatically on push
• /fs-fix-stop — disable automatic fix runs for this PR

Previous run

Review

Findings

High

• [supply-chain security regression / permission-expansion] .github/workflows/fullsend.yaml:44 — The uses reference for konflux-ci/.fullsend/.github/workflows/dispatch.yml is changed from a pinned commit SHA (@701e62a9c6f104ed68f8d4085d9c3b8bad3a82e4) to a mutable branch reference (@main). This SHA was pinned in the immediately preceding PR Pin GitHub Actions to full commit SHAs #313 ("Pin GitHub Actions to full commit SHAs"). This workflow runs on pull_request_target with actions: write and id-token: write permissions at the top level. A mutable @main reference means any commit pushed to the .fullsend repository's main branch changes the code executing with these elevated permissions, without any change visible in this repository. Every other uses: reference across all workflow files in this repository is SHA-pinned.
  Remediation: Keep the SHA-pinned reference. If the intent is to track a newer version of dispatch.yml, update to the new commit's full SHA with a trailing comment (e.g., @<new-sha> # main).

• [protected-path] .github/workflows/fullsend.yaml — This PR modifies .github/workflows/fullsend.yaml, a file under the protected .github/ path. The PR has no linked issue providing authorization for changes to governance/infrastructure files. Human approval is required for protected-path changes.

Medium

• [yaml-key-quoting-convention] .github/workflows/fullsend.yaml:26 — The workflow trigger key uses unquoted on: but all other workflow files in this repository (checkton.yaml, gitleaks.yaml, hadolint.yaml, run-task-tests.yaml, shellcheck.yaml, validate-agents-md.yaml, validate-task-and-pipeline-yamls.yaml, yaml-lint.yaml) use the quoted form "on":. This breaks the established YAML key quoting convention.
  Remediation: Change on: back to "on": to match the convention in other workflow files.

---

Labels: PR modifies a protected GitHub Actions workflow with a supply-chain security regression (SHA unpinning)

---

Next steps:

• /fs-fix — agent addresses review findings automatically
• /fs-fix <your instruction> — agent fixes with your specific guidance
• Push commits directly — review re-runs automatically on push
• /fs-fix-stop — disable automatic fix runs for this PR

Previous run (2)

Review

Findings

High

• [protected-path] .github/workflows/fullsend.yaml — This PR modifies a file under the protected .github/ path. The PR has no linked issue providing authorization for changes to governance/infrastructure files. Human approval is required for protected-path changes.

Low

• [naming-conventions] .github/workflows/fullsend.yaml:26 — Changed "on": to on: but the established codebase convention is to quote this keyword. All other 8 workflow files in .github/workflows/ consistently use "on": (quoted form). However, the PR's stated purpose is to sync this shim with the upstream .fullsend config repo template, which likely uses the unquoted form. Both forms are functionally equivalent.
  Remediation: Consider reverting to "on": to maintain consistency with the other 8 workflow files in this repository, or accept the divergence if staying in sync with the upstream template is the higher priority.

---

Next steps:

• /fs-fix — agent addresses review findings automatically
• /fs-fix <your instruction> — agent fixes with your specific guidance
• Push commits directly — review re-runs automatically on push
• /fs-fix-stop — disable automatic fix runs for this PR

Previous run (3)

Review — PR #308

Verdict: Approve — no blocking findings.

Summary

This PR removes quotes from the YAML on: key in .github/workflows/fullsend.yaml ("on": → on:). The change is functionally safe — GitHub Actions handles both forms identically. However, two convention and lint observations are worth noting.

Findings

#	Severity	Category	File	Description
1	low	lint-consistency	.github/workflows/fullsend.yaml:26	Bare on is a YAML 1.1 truthy value not in the repo's .yamllint allowed-values list (["true", "false", "yes", "no"]). This will introduce a new truthy warning from yamllint .. While the rule is at warning level (not CI-blocking), it degrades the lint-clean state.
2	low	naming-conventions	.github/workflows/fullsend.yaml:26	All 8 other workflow files in .github/workflows/ consistently use "on":. This change makes fullsend.yaml the sole outlier using bare on:, breaking the established codebase convention.

Recommendation: Keep the quoted form "on": to maintain consistency with the other workflow files and avoid the yamllint truthy warning. If the upstream .fullsend template uses bare on:, the template itself could be updated to match this repo's convention — or this repo could accept the minor inconsistency.

---

Protected paths detected — this PR modifies files under one or more
protected paths. The review agent cannot approve PRs that touch these paths.
A human reviewer must approve this PR.

Protected files in this PR:

• .github/workflows/fullsend.yaml

Previous run (4)

Review — comment

PR: #308 — chore: update fullsend shim workflow
Author: fullsend-ai-fullsend[bot]
Scope: 1 file changed (.github/workflows/fullsend.yaml) — 1 addition, 1 deletion

Summary

This PR removes the double-quotes around the YAML on key in .github/workflows/fullsend.yaml, changing "on": to bare on:. The stated intent is to sync the shim workflow with the upstream template in the .fullsend config repo.

The change is cosmetic in terms of GitHub Actions behavior (both forms are accepted), but it conflicts with this repository's yamllint configuration and will break the yamllint CI gate.

Findings

1. Removing quotes from on: will break the yamllint CI gate — medium/correctness

File: .github/workflows/fullsend.yaml, line 26

The repository's .yamllint configuration enables the truthy rule at warning level with allowed-values: ["true", "false", "yes", "no"]. In YAML 1.1, bare on is a truthy value (it resolves to boolean true), and on is not in the allowed-values list. Removing the quotes will trigger a yamllint truthy warning.

The CI workflow (yaml-lint.yaml) runs yamllint . without the -d relaxed flag or any mechanism to suppress warnings. yamllint exits with code 1 when warnings are present, which fails the GitHub Actions step.

All 9 existing workflow files in .github/workflows/ consistently use the quoted form "on": — specifically to satisfy this yamllint rule. This change would make fullsend.yaml the sole exception, breaking both CI and the established convention.

Remediation: Keep the quoted form "on": to pass yamllint and stay consistent with the rest of the repository. If the upstream .fullsend template uses bare on:, the template itself should be updated to use "on":, or the repo's .yamllint config should be adjusted (e.g., adding on to allowed-values or setting check-keys: false on the truthy rule) — but that would be a separate, deliberate decision rather than a side-effect of a template sync.

Verdict

The single-character change will break the yamllint CI gate. The fix is straightforward: retain the quotes. If the upstream template diverges on this point, the template should be adjusted rather than introducing a CI failure here.

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 8:53 AM UTC · Completed 9:01 AM UTC
Commit: 37b10e4 · View workflow run →

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 12:48 PM UTC · Completed 12:55 PM UTC
Commit: 701e62a · View workflow run →

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 9:28 PM UTC · Completed 9:40 PM UTC

Commit: 9103755 · View workflow run →

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 7:50 PM UTC · Completed 8:03 PM UTC

Commit: 9ee3c25 · View workflow run →

[fullsend-ai-review]

See the review comment for full details.

[fullsend-ai-review]

[critical] permission-expansion

The reusable workflow reference is changed from a pinned commit SHA (@701e62a9c6f104ed68f8d4085d9c3b8bad3a82e4) to a mutable branch (@main). This is a supply-chain security regression. Anyone with write access to konflux-ci/.fullsend can modify dispatch.yml on main, and this workflow will immediately execute the modified code. The dispatch job inherits top-level permissions including actions: write and id-token: write, enabling OIDC token minting. The workflow triggers on pull_request_target (access to secrets) and issue_comment (triggerable by external users).

Suggested fix: Keep the SHA-pinned reference. If the upstream workflow has legitimately changed, verify the new commit, audit the diff from the old SHA, and pin to the new verified SHA instead of using @main.

[fullsend-ai-review]

[medium] yaml-key-quoting

The trigger key uses unquoted on: while all other workflow files in this repository consistently use the quoted form. This creates a style inconsistency. yamllint's truthy rule may also flag bare on as a boolean value under YAML 1.1.

Suggested fix: Change on: back to the quoted form to match the established pattern in all other workflow files.