code.yaml

---
# harness/code.yaml — code agent with pre/post script pipeline.
#
# Flow: pre_script → sandbox (agent) → post_script
#   pre_script  : validates inputs on the runner BEFORE sandbox creation
#   agent       : reads the issue, implements, tests, scans, commits locally
#   post_script : secret scan, pre-commit, push branch, create PR/MR, assign human
#
# The agent NEVER pushes or creates PRs/MRs. Enforcement: the sandbox
# GH_TOKEN/GITLAB_TOKEN is read-only scoped, PUSH_TOKEN never enters the
# sandbox, and network policy restricts binary access per forge.
# Only the post-script, running on the runner with PUSH_TOKEN, can write.
agent: agents/code.md
doc: docs/code.md
model: opus
image: ghcr.io/fullsend-ai/fullsend-code@sha256:de3ecbd7719a1927c983142ada96475f3314d2505d0f258bcf19c31411856eb6
policy: policies/base.yaml
openshell:
  profiles:
    - profiles/fullsend-vertex-ai.yaml
    - profiles/fullsend-package-registries.yaml
    - profiles/fullsend-gitleaks.yaml
providers:
  - providers/vertex-ai.yaml
  - providers/package-registries.yaml
  - providers/gitleaks.yaml

role: coder
slug: fullsend-ai-coder

host_files:
  - src: env/gcp-vertex.env
    dest: /sandbox/workspace/.env.d/gcp-vertex.env
    expand: true
  - src: env/ssl-cainfo.env
    dest: /sandbox/workspace/.env.d/ssl-cainfo.env
    expand: true
  - src: ${GOOGLE_APPLICATION_CREDENTIALS}
    dest: /tmp/.gcp-credentials.json
  - src: ${GCP_OIDC_TOKEN_FILE}
    dest: /sandbox/workspace/.gcp-oidc-token
    optional: true

pre_script: scripts/pre-code.sh
post_script: scripts/post-code.sh

skills:
  - skills/code-implementation

plugins:
  - plugins/gopls-lsp

validation_loop:
  script: scripts/validate-output-schema.sh
  schema: schemas/code-result.schema.json
  max_iterations: 2

# Environment variables available to pre/post scripts on the runner.
# These are expanded from the runner environment and NEVER enter the sandbox.
env:
  runner:
    CODE_ALLOWED_TARGET_BRANCHES: "${CODE_ALLOWED_TARGET_BRANCHES}"
  sandbox:
    MAX_RETRIES: "1"
    TIMEOUT_SECONDS: "2100"
    GOPATH: "/sandbox/go"
    GOMODCACHE: "/sandbox/go/pkg/mod"

timeout_minutes: 35

forge:
  github:
    providers:
      - providers/github-code.yaml
    openshell:
      profiles:
        - profiles/fullsend-github-code.yaml
    pre_script: scripts/pre-code.sh
    post_script: scripts/post-code.sh
    skills:
      - skills/github-forge
    host_files:
      - src: env/github/code.env
        dest: /sandbox/workspace/.env.d/forge-code.env
        expand: true
    env:
      runner:
        PUSH_TOKEN: "${PUSH_TOKEN}"
        PUSH_TOKEN_SOURCE: "${PUSH_TOKEN_SOURCE}"
        REPO_FULL_NAME: "${REPO_FULL_NAME}"
        ISSUE_NUMBER: "${ISSUE_NUMBER}"
        ISSUE_URL: "${GITHUB_ISSUE_URL}"
        GH_TOKEN: "${GH_TOKEN}"
        FULLSEND_FORGE: github
      sandbox:
        ISSUE_NUMBER: "${ISSUE_NUMBER}"
        ISSUE_URL: "${GITHUB_ISSUE_URL}"
        GH_TOKEN: "${GH_TOKEN}"
        FULLSEND_FORGE: github
        GIT_AUTHOR_NAME: "fullsend-code"
        GIT_AUTHOR_EMAIL: "${GIT_BOT_EMAIL}"
        GIT_COMMITTER_NAME: "fullsend-code"
        GIT_COMMITTER_EMAIL: "${GIT_BOT_EMAIL}"
  gitlab:
    policy: policies/gitlab/code.yaml
    pre_script: scripts/pre-code.sh
    post_script: scripts/post-code.sh
    skills:
      - skills/gitlab-forge
    host_files:
      - src: env/gitlab/code.env
        dest: /sandbox/workspace/.env.d/forge-code.env
        expand: true
    env:
      runner:
        PUSH_TOKEN: "${PUSH_TOKEN}"
        PUSH_TOKEN_SOURCE: "${PUSH_TOKEN_SOURCE}"
        REPO_FULL_NAME: "${REPO_FULL_NAME}"
        ISSUE_NUMBER: "${ISSUE_NUMBER}"
        ISSUE_URL: "${GITLAB_ISSUE_URL}"
        GITLAB_TOKEN: "${GITLAB_TOKEN}"
        FULLSEND_FORGE: gitlab
      sandbox:
        ISSUE_NUMBER: "${ISSUE_NUMBER}"
        ISSUE_URL: "${GITLAB_ISSUE_URL}"
        GITLAB_TOKEN: "${GITLAB_TOKEN}"
        FULLSEND_FORGE: gitlab
        GIT_AUTHOR_NAME: "fullsend-code"
        GIT_AUTHOR_EMAIL: "${GIT_BOT_EMAIL}"
        GIT_COMMITTER_NAME: "fullsend-code"
        GIT_COMMITTER_EMAIL: "${GIT_BOT_EMAIL}"