Skip to content

feat(workflows): extract harness-run into reusable workflow #6356

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
ralphbean wants to merge 10 commits into from
+334 −170
Closed

feat(workflows): extract harness-run into reusable workflow #6356

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
10 commits
Select commit Hold shift + click to select a range
e40ec82
feat(workflows): extract harness-run into reusable workflow
ralphbean Aug 19, 2026
f060999
test(scaffold): update tests for harness-run extraction
ralphbean Aug 19, 2026
020c495
feat(workflows): add optional JIRA secrets to reusable workflows
ralphbean Aug 19, 2026
5bfa837
fix(#6356): propagate workflow context to reusable-harness-run
ralphbean Aug 19, 2026
5f34449
fix(#6356): address review feedback
ralphbean Aug 19, 2026
7a08e38
fix(#6356): use github context instead of job context in reusable wor…
ralphbean Aug 20, 2026
9393f44
fix(#6356): address PR review feedback on reusable-harness-run
ralphbean Aug 20, 2026
c5c24db
fix(#6356): remove workflow_sha input to reusable-harness-run
ralphbean Aug 20, 2026
698589c
fix(#6356): remove workflow_repository input, use job.workflow_reposi…
ralphbean Aug 20, 2026
cc0486c
fix(#6356): allow hyphens in reusable workflow ref regex
fullsend-ai-coder[bot] Aug 20, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
178 changes: 23 additions & 155 deletions .github/workflows/reusable-dispatch.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -73,6 +73,12 @@ on:
required: false
OTEL_EXPORTER_OTLP_HEADERS:
required: false
JIRA_TOKEN:

@fullsend-ai-review fullsend-ai-review Bot Aug 20, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[low] scope-creep

Adding JIRA_TOKEN and JIRA_USER_EMAIL secrets to the workflow_call interface extends beyond the strict scope of issue #6347 (extract harness-run), though the threading is a natural dependency of making the extracted workflow functional for Jira-integrated agents.

@ralphbean ralphbean Aug 21, 2026

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I know.. but, let it go please. It is the work that is driving this improvement.

description: "Jira Cloud API token for Jira-based agents"
required: false
JIRA_USER_EMAIL:
description: "Jira account email for Basic auth"
required: false

jobs:
route:
Expand Down Expand Up @@ -1519,165 +1525,27 @@ jobs:
} >> "${GITHUB_OUTPUT}"

harness-run:
Comment thread
ralphbean marked this conversation as resolved.
Comment thread
ralphbean marked this conversation as resolved.
name: Harness run (${{ matrix.agent }})
name: Harness run
needs: harness-dispatch
if: ${{ needs.harness-dispatch.outputs.matrix != '' && fromJSON(needs.harness-dispatch.outputs.matrix).include[0] != null }}
strategy:
fail-fast: false
matrix: ${{ fromJSON(needs.harness-dispatch.outputs.matrix) }}
concurrency:
group: fullsend-harness-${{ matrix.agent }}-${{ github.repository }}-${{ matrix.status_number }}
cancel-in-progress: true
runs-on: ${{ inputs.runner_image }}
if: needs.harness-dispatch.outputs.matrix != '' && fromJSON(needs.harness-dispatch.outputs.matrix).include[0] != null
permissions:
actions: write
contents: read
id-token: write
issues: write
pull-requests: write
steps:
- name: Checkout config repository
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
ref: ${{ github.event_name == 'pull_request_target' && github.event.pull_request.base.sha || github.sha }}
persist-credentials: false
allow-unsafe-pr-checkout: ${{ github.event_name == 'pull_request_target' }}

- name: Checkout upstream defaults
if: hashFiles('.defaults/action.yml', '.fullsend/.defaults/action.yml') == ''
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
repository: ${{ job.workflow_repository }}
ref: ${{ job.workflow_sha }}
path: .defaults
fetch-depth: 1
sparse-checkout: |
.github/actions/
.github/scripts/
internal/scaffold/fullsend-repo/
action.yml

- name: Prepare workspace (upstream defaults + org/repo overrides)
env:
INSTALL_MODE: ${{ inputs.install_mode }}
run: |
set -euo pipefail
if [[ "${INSTALL_MODE}" != "per-org" && "${INSTALL_MODE}" != "per-repo" ]]; then
printf 'Received install_mode: %q\n' "${INSTALL_MODE}"
echo "::error::Invalid install_mode: must be 'per-org' or 'per-repo'"
exit 1
fi
SRC=".defaults/internal/scaffold/fullsend-repo"
LAYERED_DIRS="agents skills schemas harness plugins policies scripts env"
DEST=""
if [[ "${INSTALL_MODE}" == "per-repo" ]]; then
DEST=".fullsend/"
fi
for dir in ${LAYERED_DIRS}; do
if [[ -d "${SRC}/${dir}" ]]; then
mkdir -p "${DEST}${dir}"
cp -r "${SRC}/${dir}/." "${DEST}${dir}/"
fi
done
mkdir -p .github/scripts
cp "${SRC}/.github/scripts/setup-agent-env.sh" .github/scripts/setup-agent-env.sh

- name: Extract repo metadata
id: repo-parts
shell: bash
env:
SOURCE_REPO: ${{ matrix.source_repo }}
run: |
set -euo pipefail
NAME="${SOURCE_REPO#*/}"
echo "name=${NAME}" >> "${GITHUB_OUTPUT}"

- name: Write dispatch event payload
shell: bash
env:
EVENT_PAYLOAD: ${{ matrix.event_payload }}
run: |
set -euo pipefail
mkdir -p .fullsend/dispatch
printf '%s' "${EVENT_PAYLOAD}" > .fullsend/dispatch/event-payload.json

- name: Mint agent token
id: app-token
uses: ./.defaults/.github/actions/mint-token
with:
role: ${{ matrix.role }}
repos: ${{ steps.repo-parts.outputs.name }}
mint_url: ${{ inputs.mint_url }}

- name: Checkout target repository
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
repository: ${{ matrix.source_repo }}
token: ${{ steps.app-token.outputs.token }}
path: target-repo
fetch-depth: 1
persist-credentials: false

- name: Setup GCP and prepare credentials
uses: ./.defaults/.github/actions/setup-gcp
with:
gcp_wif_provider: ${{ secrets.FULLSEND_GCP_WIF_PROVIDER }}
gcp_project_id: ${{ secrets.FULLSEND_GCP_PROJECT_ID }}
fullsend-dir: ${{ inputs.install_mode == 'per-repo' && '.fullsend' || '' }}

- name: Setup agent environment
shell: bash
env:
MATRIX_ROLE: ${{ matrix.role }}
GCP_PROJECT: ${{ secrets.FULLSEND_GCP_PROJECT_ID }}
GCP_REGION: ${{ inputs.gcp_region }}
run: |
set -euo pipefail
ROLE_UPPER=$(echo "${MATRIX_ROLE}" | tr '[:lower:]' '[:upper:]')
export AGENT_PREFIX="${ROLE_UPPER}_"
export "${ROLE_UPPER}_TARGET_REPO_DIR=target-repo"
export "${ROLE_UPPER}_ANTHROPIC_VERTEX_PROJECT_ID=${GCP_PROJECT}"
export "${ROLE_UPPER}_CLOUD_ML_REGION=${GCP_REGION}"
bash .github/scripts/setup-agent-env.sh

- name: Export dispatch context env
id: dispatch-env
shell: bash
env:
EVENT_PAYLOAD: ${{ matrix.event_payload }}
run: |
set -euo pipefail
URL=$(printf '%s' "${EVENT_PAYLOAD}" | jq -r '.issue.html_url // .pull_request.html_url // empty')
if [[ -z "${URL}" ]]; then
echo "::error::event_payload missing issue or pull_request html_url"
exit 1
fi
DELIM="ISSUE_URL_$(openssl rand -hex 8)"
{
echo "issue_url<<${DELIM}"
printf '%s' "${URL}"
echo
echo "${DELIM}"
} >> "${GITHUB_OUTPUT}"

- name: Run harness agent
uses: ./.defaults/
env:
GITHUB_ISSUE_URL: ${{ steps.dispatch-env.outputs.issue_url }}
REPO_FULL_NAME: ${{ matrix.source_repo }}
OTEL_EXPORTER_OTLP_ENDPOINT: ${{ vars.OTEL_EXPORTER_OTLP_ENDPOINT }}
OTEL_EXPORTER_OTLP_TRACES_ENDPOINT: ${{ vars.OTEL_EXPORTER_OTLP_TRACES_ENDPOINT }}
OTEL_EXPORTER_OTLP_TRACES_HEADERS: ${{ secrets.OTEL_EXPORTER_OTLP_TRACES_HEADERS }}
OTEL_EXPORTER_OTLP_HEADERS: ${{ secrets.OTEL_EXPORTER_OTLP_HEADERS }}
OTEL_EXPORTER_OTLP_CERTIFICATE: ${{ vars.OTEL_EXPORTER_OTLP_CERTIFICATE }}
OTEL_RESOURCE_ATTRIBUTES: ${{ vars.OTEL_RESOURCE_ATTRIBUTES }}
OTEL_SDK_DISABLED: ${{ vars.OTEL_SDK_DISABLED }}
with:
agent: ${{ matrix.agent }}
version: ${{ inputs.fullsend_version || job.workflow_sha }}
fullsend-dir: ${{ inputs.install_mode == 'per-repo' && '.fullsend' || '' }}
run-url: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
status-repo: ${{ matrix.status_repo }}
status-number: ${{ matrix.status_number }}
mint-url: ${{ inputs.mint_url }}
pr-head-sha: ${{ fromJSON(matrix.event_payload).pull_request.head.sha || '' }}
uses: ./.github/workflows/reusable-harness-run.yml
Comment thread
qodo-code-review[bot] marked this conversation as resolved.
with:
matrix: ${{ needs.harness-dispatch.outputs.matrix }}
install_mode: ${{ inputs.install_mode }}
mint_url: ${{ inputs.mint_url }}
gcp_region: ${{ inputs.gcp_region }}
fullsend_version: ${{ inputs.fullsend_version }}
runner_image: ${{ inputs.runner_image }}
secrets:
FULLSEND_GCP_WIF_PROVIDER: ${{ secrets.FULLSEND_GCP_WIF_PROVIDER }}
FULLSEND_GCP_PROJECT_ID: ${{ secrets.FULLSEND_GCP_PROJECT_ID }}
OTEL_EXPORTER_OTLP_TRACES_HEADERS: ${{ secrets.OTEL_EXPORTER_OTLP_TRACES_HEADERS }}
OTEL_EXPORTER_OTLP_HEADERS: ${{ secrets.OTEL_EXPORTER_OTLP_HEADERS }}
JIRA_TOKEN: ${{ secrets.JIRA_TOKEN }}
JIRA_USER_EMAIL: ${{ secrets.JIRA_USER_EMAIL }}
Loading
Loading