Fix stale doc refs and add GITLAB_TOKEN log masking (PR #813 follow-up)

[ggallen]

Context

PR #813 (multi-forge code agent) was merged before two review findings could be addressed. Both were flagged by the review bot on the final commit.

Findings

1. [stale-reference] Docs reference non-existent policies/github/code.yaml

docs/code.md line 183 and docs/network-policy.md lines 43 and 100 link to policies/github/code.yaml, which does not exist. The GitHub forge inherits the top-level policy: policies/base.yaml (with providers and profiles for network access). Only GitLab has a forge-specific policy file (policies/gitlab/code.yaml).

Fix: Update the three references to point to policies/base.yaml for GitHub.

2. [gha-log-masking-gap] GITLAB_TOKEN not masked in post-code script

scripts/post-code.src.sh masks PUSH_TOKEN via ::add-mask:: (line 307) but does not mask GITLAB_TOKEN. Between script start and the export GITLAB_TOKEN="${PUSH_TOKEN}" assignment at step 6, the original GITLAB_TOKEN value is used for API calls and could appear in error output without log masking.

Fix: Add ::add-mask::${GITLAB_TOKEN} next to the existing PUSH_TOKEN masking:

echo "::add-mask::${PUSH_TOKEN}"
if [ -n "${GITLAB_TOKEN:-}" ]; then
  echo "::add-mask::${GITLAB_TOKEN}"
fi

Files to change

• docs/code.md — line 183
• docs/network-policy.md — lines 43 and 100
• scripts/post-code.src.sh — after line 307
• scripts/post-code.sh — (rebuilt from src)

[fullsend-ai-triage]

🤖 Finished Triage · ✅ Success · Started 11:10 PM UTC · Completed 11:14 PM UTC

Commit: 7aa8587 · View workflow run →

[fullsend-ai-triage]

Both findings verified against the current codebase:

Finding 1 — stale policy path: policies/github/code.yaml does not exist; GitHub inherits policies/base.yaml. Three references need updating.

Finding 2 — log masking gap: Confirmed that PUSH_TOKEN is masked at line 307 but GITLAB_TOKEN is not. The token is used for API calls before being reassigned, so error output in that window could leak it.

Proposed test case

# After fix, no stale references should remain
grep -r 'policies/github/code.yaml' docs/ && echo 'FAIL: stale ref found' || echo 'PASS'

# GITLAB_TOKEN masking should be present
grep -q '::add-mask::.*GITLAB_TOKEN' scripts/post-code.src.sh && echo 'PASS' || echo 'FAIL'

# Generated script should be in sync
make script-build && git diff --exit-code scripts/post-code.sh && echo 'PASS' || echo 'FAIL: post-code.sh out of sync'

Note: post-code.sh is generated from post-code.src.sh via make script-build — both files must be updated together.

---

Labels: This is a bug fix (stale references + missing security masking) touching both docs and the code-agent post-script. The 'bug' and 'code-agent' labels match the affected component and issue type.

---

Next steps:

• /fs-code — agent creates a PR to implement this issue
• /fs-code <your instruction> — agent implements with your specific guidance

[fullsend-ai-coder]

🤖 Finished Code · ✅ Success · Started 11:15 PM UTC · Completed 11:21 PM UTC

Commit: 7aa8587 · View workflow run →