GitLab agent template missing CODE_ALLOWED_TARGET_BRANCHES (harness env validation failure)

[ggallen]

Problem

The GitLab code agent fails at harness env validation before the pre-script runs:

Error: validating env: env.runner[CODE_ALLOWED_TARGET_BRANCHES]: host variable CODE_ALLOWED_TARGET_BRANCHES is not set (referenced in "${CODE_ALLOWED_TARGET_BRANCHES}")

Pipeline: https://gitlab.cee.redhat.com/gallen/integration-service/-/pipelines/17086031

Root cause

harness/code.yaml (fullsend-ai/agents) declares CODE_ALLOWED_TARGET_BRANCHES: "${CODE_ALLOWED_TARGET_BRANCHES}" in the top-level env.runner section. The harness engine's os.Expand rejects unset variables.

On GitHub, reusable-code.yml:191 sets this to '' in the workflow env block — the variable exists (empty), so os.Expand succeeds and the post-script's ${CODE_ALLOWED_TARGET_BRANCHES:-} check skips the branch restriction logic.

On GitLab, fullsend-agent.yml only sets FULLSEND_FORGE: "gitlab" in its variables: section. CODE_ALLOWED_TARGET_BRANCHES is never set, so the harness engine fails.

Fix

Add CODE_ALLOWED_TARGET_BRANCHES: '' to the GitLab agent template's variables: section in internal/scaffold/fullsend-repo-gitlab/.gitlab/ci/fullsend-agent.yml, matching the GitHub pattern.

Broader pattern

Any top-level env.runner variable in a harness that uses a "${VAR}" passthrough will fail on GitLab if the variable isn't set in the GitLab CI config. Currently affected harnesses with top-level passthroughs:

Harness	Variable	Multi-forge?	Affected?
code.yaml	CODE_ALLOWED_TARGET_BRANCHES	Yes (GitHub + GitLab)	Yes — current failure
fix.yaml	TARGET_BRANCH, TRIGGER_SOURCE, HUMAN_INSTRUCTION, FIX_ITERATION, REVIEW_BODY_FILE, PRE_AGENT_HEAD	No (GitHub-only)	Not yet — will break when multi-forged
scribe.yaml	SCRIBE_REPO, SCRIBE_*, GH_TOKEN, CONTENTS_TOKEN	No (GitHub-only)	Not yet

triage.yaml and review.yaml have no top-level passthroughs, so they're unaffected.

Related: #5799 (verify ${VAR} substitution semantics for unset harness env vars)

Context

This surfaced during the first real GitLab code agent run after fullsend-ai/agents#813 (multi-forge code agent, PR branch agent/807-multi-forge-code). The same pipeline previously hit GITLAB_HOST not set — that was fixed in the agents repo by removing GITLAB_HOST from the harness env (it's derived from ISSUE_URL at runtime by all consumers).

[fullsend-ai-triage]

🤖 Finished Triage · ✅ Success · Started 2:28 AM UTC · Completed 2:31 AM UTC

Commit: 7aa8587 · View workflow run →

[fullsend-ai-triage]

Severity: High

This completely blocks GitLab code agent runs — the agent aborts at harness env validation before any work begins.

Recommended fix

Add CODE_ALLOWED_TARGET_BRANCHES: '' to the variables: section in internal/scaffold/fullsend-repo-gitlab/.gitlab/ci/fullsend-agent.yml.

Broader pattern

As noted, other harnesses (fix.yaml, scribe.yaml) have similar ${VAR} passthroughs that will break when multi-forged. Those are GitHub-only today so not immediately affected, but the same fix pattern will be needed.

Related work

• Verify ${VAR} substitution semantics for unset harness env vars #5799 tracks the broader question of ${VAR} substitution semantics for unset harness env vars — this fix addresses the immediate symptom while that issue covers the systemic concern.

Proposed test case

// TestHarnessPassthroughVariablesCoveredByForgeTemplates validates that
// every ${VAR} reference in harness env.runner sections has a corresponding
// declaration in both the GitHub reusable workflow and the GitLab agent template.
func TestHarnessPassthroughVariablesCoveredByForgeTemplates(t *testing.T) {
    // 1. Parse each harness YAML under harness/ for env.runner entries
    //    matching the pattern ${VAR_NAME}
    // 2. For each referenced variable, verify it exists in:
    //    - .github/workflows/reusable-code.yml env block
    //    - internal/scaffold/fullsend-repo-gitlab/.gitlab/ci/fullsend-agent.yml variables section
    // 3. Fail with a descriptive message listing any missing variables
}

---

Labels: This is a confirmed bug in the GitLab scaffold component affecting agent harness env validation. High priority because it completely blocks GitLab code agent runs.

---

Next steps:

• /fs-code — agent creates a PR to implement this issue
• /fs-code <your instruction> — agent implements with your specific guidance

[fullsend-ai-coder]

🤖 Finished Code · ✅ Success · Started 2:32 AM UTC · Completed 2:40 AM UTC

Commit: 7aa8587 · View workflow run →