Skip to content

feat(#814): make review agent multi-forge (GitHub + GitLab) - #815

Open
fullsend-ai-coder[bot] wants to merge 1 commit into
mainfrom
agent/814-review-multi-forge
Open

feat(#814): make review agent multi-forge (GitHub + GitLab)#815
fullsend-ai-coder[bot] wants to merge 1 commit into
mainfrom
agent/814-review-multi-forge

Conversation

@fullsend-ai-coder

@fullsend-ai-coder fullsend-ai-coder Bot commented Aug 15, 2026

Copy link
Copy Markdown
Contributor

Summary

Add multi-forge (GitHub + GitLab) support to the review agent, following the patterns established by the triage agent in PR #686.

Infrastructure

  • Forge ops layer: review-ops.lib.sh dispatcher + github-review-ops.lib.sh (gh CLI) + gitlab-review-ops.lib.sh (curl/GitLab API) providing forge_* functions for URL validation, PR queries, review posting, label management, comments, and stale-head detection
  • Script conversion: pre-review.sh and post-review.sh converted to .src.sh source files that use forge ops, bundled via make script-build

Configuration

  • Per-forge env files (env/github/review.env, env/gitlab/review.env)
  • Per-forge sandbox policies (policies/github/review.yaml, policies/gitlab/review.yaml)
  • Per-forge pr-review skill variants (skills/pr-review/github/SKILL.md, skills/pr-review/gitlab/SKILL.md)
  • Updated harness/review.yaml with forge.gitlab section mirroring the triage pattern

Env var naming

Following the triage pattern: GITHUB_PR_URL → forge-neutral PR_URL (set by harness per forge), FULLSEND_FORGE added for dispatch.

Upstream dependency

GitLab review posting depends on fullsend post-review --forge gitlab support (fullsend-ai/fullsend#6240). The gitlab-review-ops.lib.sh passes --forge gitlab to fullsend post-review — this will work once the upstream change lands.

Testing

  • All 12 pre-review tests pass with updated env vars
  • All 71 post-review integration tests pass (severity filtering, label actions, protected paths, draft PRs, validated dirs, body content)
  • make check-bundle confirms bundled scripts match source
  • Pre-existing post-retro test failures (10 tests) confirmed on main — unrelated to this change

Closes #814

Post-script verification

  • Branch is not main/master (agent/814-review-multi-forge)
  • Secret scan passed (gitleaks — 693ed83bbd5289e1ef13d6c7a3772f61efc43c86..HEAD)
  • PR body secret scan passed (gitleaks — no-git)

@fullsend-ai-coder
fullsend-ai-coder Bot requested a review from a team as a code owner August 15, 2026 02:41
@fullsend-ai-review

fullsend-ai-review Bot commented Aug 15, 2026 •
edited
Loading

Copy link
Copy Markdown

🤖 Finished Review · ✅ Success · Started 2:42 AM UTC · Completed 3:02 AM UTC

Commit: c5b0ed7 · View workflow run →

@fullsend-ai-review

fullsend-ai-review Bot commented Aug 15, 2026 •
edited
Loading

Copy link
Copy Markdown

Review

Findings

Medium

  • [secrets-handling] harness/review.yaml:99 — The GitLab forge section injects GITLAB_TOKEN with api scope (read+write) into the sandbox. On GitHub, the sandbox policy blocks curl from the binary allowlist, providing defense-in-depth alongside the network policy's access: read-only. On GitLab, curl is allowed (needed for API access), so the network policy is the sole control preventing write mutations.
    Remediation: Inject a separate read-only scoped GitLab token (read_api scope) for the sandbox.

  • [upstream-dependency] scripts/lib/gitlab-review-ops.lib.sh:129 — forge_post_review() calls fullsend post-review --forge gitlab, which depends on Make fullsend post-review multi-forge (add --forge flag) fullsend#6240. If the upstream change has not landed, GitLab review workflows will fail at the post-review step.
    Remediation: Ensure Make fullsend post-review multi-forge (add --forge flag) fullsend#6240 is merged before deploying.

  • [breaking-change] harness/review.yaml — Structural changes for multi-forge support: policy, pre_script, post_script, and forge-specific skills/host_files moved from top-level to forge.github.*/forge.gitlab.* sections. File paths changed (env/review.env → env/github/review.env, policies/review.yaml → policies/github/review.yaml). Env var key renamed GITHUB_PR_URL → PR_URL. Downstream repos with base: composition will need to update overrides when bumping their pinned SHA. Follows the pattern from triage agent PR feat: make triage agent multi-forge (GitHub + GitLab) #686.
    Remediation: Document migration path in release notes.

  • [protected-path] agents/review.md, harness/review.yaml, policies/, scripts/, skills/, .github/, AGENTS.md — This PR modifies 18 files under protected paths (agents/, harness/, policies/, scripts/, skills/, .github/, AGENTS.md). The PR links to issue Make review agent multi-forge (GitHub + GitLab) #814 which authorizes the multi-forge work, and the description explains the rationale. Human approval is always required for protected-path changes, regardless of context.

Low

  • [error-handling] scripts/lib/gitlab-review-ops.lib.sh:93 — forge_get_pr_info() returns {state: "UNKNOWN", isDraft: false} on API failure. The caller in post-review.src.sh now produces a clear warning and exits gracefully (exit 0). Improved from prior review.

  • [GHA-workflow-command-injection] scripts/lib/gitlab-review-ops.lib.sh:136 — In forge_add_label(), the warning message on failure interpolates the label name without sanitization. Goes to stderr (not GHA-parsed stdout), but inconsistent with GitHub counterpart which uses _gha_sanitize().

  • [GHA-workflow-command-injection] scripts/post-review.src.sh:148 — Inconsistent sanitization approaches between the label validation loop (LA_LABEL=${LA_LABEL//::/:}) and _gha_sanitize() (sed 's/::/%3A%3A/g'). The regex allowlist at line 154 independently blocks most injection payloads, but the multi-layered inconsistency creates fragility.

  • [SSRF-host-validation] scripts/lib/gitlab-review-ops.lib.sh:55 — Both forge_validate_pr_url() and forge_parse_pr_url() independently validate the GitLab host against the allowlist. Correctly implemented as defense-in-depth. forge_parse_pr_url() duplicates the validation (the triage-ops equivalent does not), but the duplication is a deliberate safety net.

  • [authorization] scripts/lib/gitlab-review-ops.lib.sh:144 — Non-atomic close-with-comment on GitLab: note post and state change are separate API calls with || true. If the note succeeds but the close fails, the MR has a misleading comment without being closed.

Previous run

Review

Findings

Medium

  • [secrets-handling] harness/review.yaml:89 — The GitLab forge section injects GITLAB_TOKEN with api scope (read+write) into the sandbox. On GitHub, the sandbox policy blocks curl from the binary allowlist, providing defense-in-depth alongside the network policy's access: read-only. On GitLab, curl is allowed (needed for API access), so the network policy is the sole control preventing write mutations.
    Remediation: Inject a separate read-only scoped GitLab token (read_api scope) for the sandbox.

  • [upstream-dependency] scripts/lib/gitlab-review-ops.lib.sh:129 — forge_post_review() calls fullsend post-review --forge gitlab, which depends on Make fullsend post-review multi-forge (add --forge flag) fullsend#6240. If the upstream change has not landed, GitLab review workflows will fail at the post-review step.
    Remediation: Ensure Make fullsend post-review multi-forge (add --forge flag) fullsend#6240 is merged before deploying.

  • [breaking-change] harness/review.yaml — Structural changes for multi-forge support: policy, pre_script, post_script, and forge-specific skills/host_files moved from top-level to forge.github.*/forge.gitlab.* sections. File paths changed (env/review.env → env/github/review.env, policies/review.yaml → policies/github/review.yaml). Env var key renamed GITHUB_PR_URL → PR_URL. Downstream repos with base: composition will need to update overrides when bumping their pinned SHA. Follows the pattern from triage agent PR feat: make triage agent multi-forge (GitHub + GitLab) #686.
    Remediation: Document migration path in release notes.

  • [protected-path] agents/review.md, harness/review.yaml, policies/, scripts/, skills/, .github/, AGENTS.md — This PR modifies 18 files under protected paths (agents/, harness/, policies/, scripts/, skills/, .github/, AGENTS.md). The PR links to issue Make review agent multi-forge (GitHub + GitLab) #814 which authorizes the multi-forge work, and the description explains the rationale. Human approval is always required for protected-path changes, regardless of context.

Low

  • [error-handling] scripts/lib/gitlab-review-ops.lib.sh:93 — forge_get_pr_info() returns {state: "UNKNOWN", isDraft: false} on API failure. The caller in post-review.src.sh now produces a clear warning and exits gracefully (exit 0). Improved from prior review.

  • [GHA-workflow-command-injection] scripts/post-review.src.sh:148 — Inconsistent sanitization approaches between the label validation loop (LA_LABEL=${LA_LABEL//::/:}) and _gha_sanitize() (sed 's/::/%3A%3A/g'). The regex allowlist at line 154 independently blocks most injection payloads, but the multi-layered inconsistency creates fragility.

  • [SSRF-host-validation] scripts/lib/gitlab-review-ops.lib.sh:55 — Both forge_validate_pr_url() and forge_parse_pr_url() independently validate the GitLab host against the allowlist. Correctly implemented as defense-in-depth.

  • [authorization] scripts/lib/gitlab-review-ops.lib.sh:144 — Non-atomic close-with-comment on GitLab: note post and state change are separate API calls with || true. If the note succeeds but the close fails, the MR has a misleading comment without being closed.

  • [naming-consistency] scripts/lib/github-review-ops.lib.sh:133 — forge_list_labels() diverges from the established triage-ops naming convention forge_list_repo_labels(). Both github-triage-ops.lib.sh and gitlab-triage-ops.lib.sh use forge_list_repo_labels().

  • [code-organization] scripts/lib/gitlab-review-ops.lib.sh:68 — forge_parse_pr_url() duplicates the GitLab host allowlist validation already performed by forge_validate_pr_url(). The triage-ops equivalent does NOT duplicate the host validation.

  • [incomplete-doc] FEATURES.md:94 — The generated-scripts list enumerates six scripts but does not include scripts/pre-review.sh and scripts/post-review.sh, which this PR converts to generated bundles built from .src.sh sources via make script-build.

Previous run (2)

Review

Findings

Medium

  • [error-handling] scripts/lib/github-review-ops.lib.sh:45 — GitHub forge_get_pr_info() has no error handling. If gh pr view fails, the function propagates the non-zero exit code. Under set -euo pipefail, this terminates the post-review script immediately, bypassing the UNKNOWN state handler (post-review.src.sh:54) that was added for exactly this scenario. The GitLab counterpart catches the failure and returns {state: "UNKNOWN", isDraft: false}, enabling graceful skip.
    Remediation: Add error handling matching the GitLab pattern: gh pr view ... 2>/dev/null || { jq -n '{state: "UNKNOWN", isDraft: false}'; return; }.

  • [secrets-handling] harness/review.yaml:89 — The GitLab forge section injects GITLAB_TOKEN with api scope (read+write) into the sandbox. On GitHub, the sandbox policy blocks curl from the binary allowlist, providing defense-in-depth alongside the network policy's access: read-only. On GitLab, curl is allowed (needed for API access), so the network policy is the sole control preventing write mutations.
    Remediation: Inject a separate read-only scoped GitLab token (read_api scope) for the sandbox.

  • [upstream-dependency] scripts/lib/gitlab-review-ops.lib.sh:129 — forge_post_review() calls fullsend post-review --forge gitlab, which depends on Make fullsend post-review multi-forge (add --forge flag) fullsend#6240. If the upstream change has not landed, GitLab review workflows will fail at the post-review step.
    Remediation: Ensure Make fullsend post-review multi-forge (add --forge flag) fullsend#6240 is merged before deploying.

  • [breaking-change] harness/review.yaml — Structural changes for multi-forge support: policy, pre_script, post_script, and forge-specific skills/host_files moved from top-level to forge.github.*/forge.gitlab.* sections. File paths changed (env/review.env → env/github/review.env, policies/review.yaml → policies/github/review.yaml). Env var key renamed GITHUB_PR_URL → PR_URL. Downstream repos with base: composition will need to update overrides when bumping their pinned SHA. Follows the pattern from triage agent PR feat: make triage agent multi-forge (GitHub + GitLab) #686.
    Remediation: Document migration path in release notes.

  • [protected-path] agents/review.md, harness/review.yaml, policies/, scripts/, skills/, .github/, AGENTS.md — This PR modifies 18 files under protected paths (agents/, harness/, policies/, scripts/, skills/, .github/, AGENTS.md). The PR links to issue Make review agent multi-forge (GitHub + GitLab) #814 which authorizes the multi-forge work, and the description explains the rationale. Human approval is always required for protected-path changes, regardless of context.

Low

  • [logic-error] scripts/lib/gitlab-review-ops.lib.sh:99 — jq -r '.draft // false' uses jq's alternative operator which treats false as falsy, producing the correct result by coincidence. Functionally correct in all cases but relies on the coincidental equivalence of both branches.

  • [GHA-workflow-command-injection] scripts/lib/gitlab-review-ops.lib.sh:189 — Inconsistent sanitization approaches between the label validation loop (LA_LABEL=${LA_LABEL//::/:}) and _gha_sanitize(). The defense chain currently blocks injection, but the multi-layered inconsistency creates fragility.

  • [naming-consistency] scripts/lib/gitlab-review-ops.lib.sh:98 — _gha_sanitize() references "GHA" (GitHub Actions) but is called from GitLab forge operations. The ::warning:: workflow command syntax emitted by forge_add_label() is GHA-specific and will appear as literal text in GitLab CI logs.

  • [error-handling] scripts/lib/gitlab-review-ops.lib.sh:93 — forge_get_pr_info() returns {state: "UNKNOWN", isDraft: false} on API failure. The caller now produces a clear warning and exits gracefully. Improved from prior review.

  • [edge-case] scripts/lib/gitlab-review-ops.lib.sh:123 — forge_get_pr_files() pagination uses duplicate detection and sort -u. On pre-15.7 GitLab instances without pagination support, the heuristic correctly breaks. Net result is correct.

  • [test-adequacy] scripts/post-review-test.sh:1450 — No GitLab test for forge_get_pr_info API failure path (UNKNOWN state handler). The curl mock always succeeds.

  • [test-adequacy] scripts/pre-review-test.sh:334 — No GitLab test for closed/merged MR state-check path. The curl mock always returns opened.

  • [SSRF-host-validation] scripts/lib/gitlab-review-ops.lib.sh:55 — Both forge_validate_pr_url() and forge_parse_pr_url() now independently validate the GitLab host against the allowlist. Improved from prior review.

  • [authorization] scripts/lib/gitlab-review-ops.lib.sh:144 — Non-atomic close-with-comment on GitLab: note post and state change are separate API calls with || true. If the note succeeds but the close fails, the MR has a misleading comment without being closed.

  • [incomplete-doc] docs/review.md:18 — The Triggers section uses "PR" exclusively without mentioning GitLab MRs. The Variables table in the same file was updated to use "PR/MR", creating terminology inconsistency.

Next steps:

  • /fs-fix — agent addresses review findings automatically
  • /fs-fix <your instruction> — agent fixes with your specific guidance
  • Push commits directly — review re-runs automatically on push
  • /fs-fix-stop — disable automatic fix runs for this PR
Previous run (3)

Review

Findings

Medium

  • [protected-path] agents/review.md, harness/review.yaml, policies/, scripts/, skills/, .github/, AGENTS.md — This PR modifies 18 files under protected paths (agents/, harness/, policies/, scripts/, skills/, .github/, AGENTS.md). The PR links to issue Make review agent multi-forge (GitHub + GitLab) #814 which authorizes the multi-forge work, and the description explains the rationale. Human approval is always required for protected-path changes, regardless of context.

  • [upstream-dependency] scripts/lib/gitlab-review-ops.lib.sh:129 — forge_post_review() calls fullsend post-review --forge gitlab, which depends on Make fullsend post-review multi-forge (add --forge flag) fullsend#6240. If the upstream change has not landed, GitLab review workflows will fail at the post-review step.
    Remediation: Ensure Make fullsend post-review multi-forge (add --forge flag) fullsend#6240 is merged before deploying.

  • [secrets-handling] harness/review.yaml:89 — The GitLab forge section injects GITLAB_TOKEN into the sandbox with write-capable scope. On GitHub, the sandbox policy blocks curl to prevent raw HTTP access with the injected token. On GitLab, curl is allowed (needed for API access), and the only control preventing write mutations is the network policy's access: read-only enforcement. If that enforcement is bypassed, the sandboxed agent could perform write operations.
    Remediation: Consider injecting a separate read-only scoped GitLab token (e.g., project access token with read_api scope) for defense-in-depth.

  • [breaking-change] harness/review.yaml, env/github/review.env, policies/github/review.yaml — Structural changes for multi-forge support: policy, pre_script, post_script, and forge-specific skills/host_files moved from top-level to forge.github.*/forge.gitlab.* sections. File paths changed (env/review.env → env/github/review.env, policies/review.yaml → policies/github/review.yaml). Env var key renamed GITHUB_PR_URL → PR_URL. Downstream repos with base: composition will need to update overrides when bumping their pinned SHA. Follows the pattern from triage agent PR feat: make triage agent multi-forge (GitHub + GitLab) #686.
    Remediation: Document migration path in release notes.

Low

  • [error-handling] scripts/lib/gitlab-review-ops.lib.sh:89 — forge_get_pr_info() returns {state: "UNKNOWN", isDraft: false} when the GitLab API call fails. The caller produces a confusing "PR is unknown" skip comment. The fail-safe direction (skip review) is correct, but the message is misleading.
    Remediation: Return a distinguishable error state or improve the skip message to indicate an API failure.

  • [edge-case] scripts/lib/gitlab-review-ops.lib.sh:113 — forge_get_pr_files() paginates the GitLab /changes endpoint, but on GitLab instances pre-15.7 where this endpoint does not support pagination, page 2 returns the same response as page 1, causing duplicate file paths. Duplicates do not affect the protected-path decision (which checks "is non-empty") but produce duplicate log lines.

  • [SSRF-host-validation] scripts/lib/gitlab-review-ops.lib.sh:42 — forge_validate_pr_url() validates the host against an allowlist, and forge_parse_pr_url() extracts GITLAB_HOST independently without re-checking. Both are called in correct order under set -euo pipefail, and the network policy independently restricts hosts. The concern is structural: no guard inside forge_parse_pr_url prevents a future caller from skipping validation.
    Remediation: Add defensive validation inside forge_parse_pr_url() or combine parse and validate.

Previous run (4)

Review

Findings

Medium

Low

  • [edge-case] scripts/lib/gitlab-review-ops.lib.sh:113 — forge_get_pr_files() uses GitLab's /changes endpoint with no pagination. GitLab added pagination to this endpoint (default 100 changes per page). MRs with more than 100 changed files may miss protected files beyond the first page, allowing an approve that should have been downgraded.
    Remediation: Add pagination handling similar to forge_list_labels().

  • [test-coverage] scripts/post-review-test.sh — GitLab tests cover basic approve/request-changes flows and verify no gh calls are made. They don't exercise protected-path checking, severity filtering, label-actions validation, draft-PR handling, or stale-head redispatch under FULLSEND_FORGE=gitlab. Core logic uses the forge_* abstraction so the existing GitHub tests cover the same logic paths.

  • [error-handling] scripts/lib/gitlab-review-ops.lib.sh:100 — forge_get_pr_info() returns an empty/null state when the GitLab API call fails. The caller produces a confusing "PR is , skipping review" message. The fail-safe direction (skip) is correct, but the message is misleading.
    Remediation: Return a distinguishable error state (e.g., UNKNOWN) or let the failure propagate.

  • [breaking-change] harness/review.yaml, env/github/review.env, policies/github/review.yaml — Structural changes for multi-forge support: policy, pre_script, post_script, and forge-specific skills/host_files moved from top-level to forge.github.*/forge.gitlab.* sections. File paths changed (env/review.env → env/github/review.env, policies/review.yaml → policies/github/review.yaml). Env var key renamed GITHUB_PR_URL → PR_URL (host-side GITHUB_PR_URL still consumed via harness mapping). Downstream repos with base: composition will need to update overrides when bumping their pinned SHA. Follows the pattern from triage agent PR feat: make triage agent multi-forge (GitHub + GitLab) #686.
    Remediation: Document migration path in release notes.

Previous run (5)

Review

Findings

Medium

Low

  • [edge-case] scripts/lib/gitlab-review-ops.lib.sh:113 — forge_get_pr_files() uses GitLab's /changes endpoint with no pagination. GitLab added pagination to this endpoint (default 100 changes per page). MRs with more than 100 changed files may miss protected files beyond the first page, allowing an approve that should have been downgraded.
    Remediation: Add pagination handling similar to forge_list_labels().

  • [test-inadequate] scripts/post-review-test.sh — GitLab tests only cover basic approve/request-changes flows and verify no gh calls are made. They don't exercise protected-path checking, severity filtering, label-actions validation, draft-PR handling, or stale-head redispatch paths under FULLSEND_FORGE=gitlab. Core logic uses the forge_* abstraction so the existing GitHub tests cover the same logic paths.

  • [stale-doc] docs/review.md:90 — REVIEW_SKIP_AUTHORS variable description says "Comma-separated list of GitHub usernames" but with multi-forge support, GitLab usernames are equally valid when FULLSEND_FORGE=gitlab.
    Remediation: Change to "forge usernames" or "GitHub/GitLab usernames".

Previous run (6)

Review

Findings

Medium

  • [protected-path] agents/review.md, harness/review.yaml, policies/, scripts/, skills/ — This PR modifies 15 files under protected paths (agents/, harness/, policies/, scripts/, skills/). The PR links to issue Make review agent multi-forge (GitHub + GitLab) #814 which authorizes the multi-forge work, and the description explains the rationale. Human approval is always required for protected-path changes, regardless of context.

  • [env-var-breaking-change] harness/review.yaml — The harness env key was renamed from GITHUB_PR_URL to PR_URL in forge.github.env.runner. The value still resolves from ${GITHUB_PR_URL}, so the host-side source is unchanged. Downstream consumers extending the harness that reference the GITHUB_PR_URL key by name will need to update. This follows the established triage pattern (GITHUB_ISSUE_URL → ISSUE_URL from PR feat: make triage agent multi-forge (GitHub + GitLab) #686).
    Remediation: Document the key rename in release notes alongside the triage agent's analogous rename.

  • [file-path-breaking-change] harness/review.yaml — Policy file moved from top-level policy: policies/review.yaml to per-forge forge.github.policy: policies/github/review.yaml. The old file still exists on disk but is no longer referenced by the harness. Downstream repos extending via base: composition may need to update.
    Remediation: Document migration in release notes.

  • [file-path-breaking-change] harness/review.yaml — Env file moved from top-level host_files (env/review.env) to per-forge (env/github/review.env). The old file still exists on disk. Same migration concern as the policy path change.
    Remediation: Document migration in release notes.

  • [stale-reference] .github/scripts/select-eval-agents-test.sh:75 — Test constructs a mock harness/review.yaml with policy: policies/review.yaml (line 75) and env/review.env (line 84) references that no longer match the production harness structure where these moved to per-forge sections.
    Remediation: Update test YAML to reflect the new harness structure with forge-specific paths.

  • [secrets-handling] env/github/review.env:2 — Unquoted variable expansion export GH_TOKEN=${GH... is subject to word splitting and globbing. All other exports in both env files correctly use double quotes. This is a pre-existing pattern carried forward from the old env/review.env. Remediation: Quote the expansion: export GH_TOKEN="${GH..."`.

  • [upstream-dependency] scripts/lib/gitlab-review-ops.lib.sh:148 — forge_post_review() calls fullsend post-review --forge gitlab, which depends on Make fullsend post-review multi-forge (add --forge flag) fullsend#6240. If the upstream change hasn't landed, GitLab review workflows will fail at the post-review step.
    Remediation: Ensure Make fullsend post-review multi-forge (add --forge flag) fullsend#6240 is merged before deploying.

  • [stale-doc] AGENTS.md:157 — References GITHUB_PR_URL as a computed passthrough in forge.github.env.runner blocks. After this PR, the harness key is PR_URL (the value ${GITHUB_PR_URL} is unchanged, but the key name is stale).
    Remediation: Update line 157 to reference PR_URL.

Low

  • [stale-reference] skills/pr-review/SKILL.md:236 — Comment references env/review.env (old path). The PR adds per-forge env files but does not update this shared skill file.
  • [gha-workflow-command-injection] scripts/lib/gitlab-review-ops.lib.sh:98 — forge_add_label() emits ::warning:: with unsanitized ${label}. Mitigated by the post-review caller's regex allowlist validation, but _gha_sanitize() is available and not used. Same pattern in GitHub ops.
  • [skill-path-breaking-change] harness/review.yaml:214 — skills/issue-labels/github moved from top-level skills: array to forge-specific forge.github.skills. Mitigated by basename deduplication in skill resolution (AGENTS.md §7).
  • [error-handling-idiom] scripts/lib/github-review-ops.lib.sh:113 — forge_add_label() continues on error (echoes ::warning::) vs the triage ops pattern of returning 1. The divergence is appropriate for the review pipeline's best-effort label application context.
  • [error-handling-idiom] scripts/lib/gitlab-review-ops.lib.sh:104 — Same divergence from triage ops error-handling pattern.
  • [test-inadequate] scripts/post-review-test.sh — All 15+ test functions set FULLSEND_FORGE=github but no test exercises the GitLab forge path. The entire gitlab-review-ops.lib.sh code path has zero test coverage.
  • [jq-filter-injection] scripts/lib/github-review-ops.lib.sh:87 — forge_get_recent_redispatch_comments interpolates marker and window_seconds directly into a jq filter string. The GitLab variant uses the safer --arg/--argjson binding. Not exploitable with current hardcoded callers.

Labels: PR modifies review agent infrastructure

fullsend-ai-review[bot]

This comment was marked as outdated.

Sign in to view

@fullsend-ai-review fullsend-ai-review Bot added requires-manual-review Review requires human judgment review-agent labels Aug 15, 2026
@ggallen
ggallen force-pushed the agent/814-review-multi-forge branch from c5b0ed7 to 8864cf8 Compare August 15, 2026 12:25
@fullsend-ai-review

fullsend-ai-review Bot commented Aug 15, 2026 •
edited
Loading

Copy link
Copy Markdown

🤖 Finished Review · ✅ Success · Started 12:26 PM UTC · Completed 12:44 PM UTC

Commit: 8864cf8 · View workflow run →

fullsend-ai-review[bot]

This comment was marked as outdated.

Sign in to view

@ggallen
ggallen force-pushed the agent/814-review-multi-forge branch from 8864cf8 to 7e97bca Compare August 15, 2026 12:48
@fullsend-ai-review

fullsend-ai-review Bot commented Aug 15, 2026 •
edited
Loading

Copy link
Copy Markdown

🤖 Finished Review · ✅ Success · Started 12:50 PM UTC · Completed 1:06 PM UTC

Commit: 7e97bca · View workflow run →

@ggallen ggallen mentioned this pull request Aug 15, 2026
Open
fullsend-ai-review[bot]

This comment was marked as outdated.

Sign in to view

@ggallen
ggallen force-pushed the agent/814-review-multi-forge branch from 7e97bca to 1327121 Compare August 15, 2026 17:13
@fullsend-ai-review

fullsend-ai-review Bot commented Aug 15, 2026 •
edited
Loading

Copy link
Copy Markdown

🤖 Finished Review · ✅ Success · Started 5:14 PM UTC · Completed 5:33 PM UTC

Commit: 1327121 · View workflow run →

fullsend-ai-review[bot]

This comment was marked as outdated.

Sign in to view

@ggallen
ggallen force-pushed the agent/814-review-multi-forge branch from 1327121 to 20d17b7 Compare August 15, 2026 17:40
@fullsend-ai-review

fullsend-ai-review Bot commented Aug 15, 2026 •
edited
Loading

Copy link
Copy Markdown

🤖 Finished Review · ✅ Success · Started 5:42 PM UTC · Completed 6:00 PM UTC

Commit: 20d17b7 · View workflow run →

fullsend-ai-review[bot]

This comment was marked as outdated.

Sign in to view

@fullsend-ai-review fullsend-ai-review Bot removed the requires-manual-review Review requires human judgment label Aug 15, 2026
@ggallen
ggallen force-pushed the agent/814-review-multi-forge branch from 20d17b7 to b62861d Compare August 15, 2026 18:03
@fullsend-ai-review

fullsend-ai-review Bot commented Aug 15, 2026 •
edited
Loading

Copy link
Copy Markdown

🤖 Finished Review · ✅ Success · Started 6:04 PM UTC · Completed 6:23 PM UTC

Commit: b62861d · View workflow run →

@fullsend-ai-triage fullsend-ai-triage Bot mentioned this pull request Aug 15, 2026
Open
@fullsend-ai-review
fullsend-ai-review Bot dismissed their stale review August 15, 2026 18:23

Superseded by updated review

fullsend-ai-review[bot]

This comment was marked as outdated.

Sign in to view

@fullsend-ai-review fullsend-ai-review Bot added the requires-manual-review Review requires human judgment label Aug 15, 2026
@ggallen @claude
feat(#814): make review agent multi-forge (GitHub + GitLab)
0fa7dfb 
Signed-off-by: Greg Allen <gallen@redhat.com>
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
@ggallen
ggallen force-pushed the agent/814-review-multi-forge branch from b62861d to 0fa7dfb Compare August 15, 2026 18:32
@fullsend-ai-review

fullsend-ai-review Bot commented Aug 15, 2026 •
edited
Loading

Copy link
Copy Markdown

🤖 Finished Review · ✅ Success · Started 6:33 PM UTC · Completed 6:48 PM UTC

Commit: 0fa7dfb · View workflow run →

fullsend-ai-review[bot]
fullsend-ai-review Bot reviewed Aug 15, 2026
View reviewed changes

@fullsend-ai-review fullsend-ai-review Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

See the review comment for full details.

Comment thread harness/review.yaml
Comment thread scripts/lib/gitlab-review-ops.lib.sh
Comment thread scripts/lib/gitlab-review-ops.lib.sh
Comment thread scripts/lib/gitlab-review-ops.lib.sh
Comment thread scripts/post-review.src.sh
Comment thread scripts/lib/gitlab-review-ops.lib.sh
Comment thread scripts/lib/gitlab-review-ops.lib.sh
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@ggallen ggallen ggallen left review comments
+1 more reviewer
@fullsend-ai-review fullsend-ai-review[bot] fullsend-ai-review[bot] left review comments
Reviewers whose approvals may not affect merge requirements

At least 1 approving review is required to merge this pull request.

Assignees

@ggallen ggallen

Labels

ready-for-review requires-manual-review Review requires human judgment review-agent

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Make review agent multi-forge (GitHub + GitLab)

1 participant

@ggallen