Repository navigation
Conversation
Move the GitHub verify-pr dispatch off CLI v0.43.0 and reusable-dispatch d5f36921 to the supported fullsend commit 9f188578 (both pins together, as the runner-owned credential model requires). Drop the now-ignored install_mode input; the nested-job permission union is unchanged. Re-pin both harness bases to main merge commit 0bcdff9 and regenerate lock.yaml with a CLI built at 9f188578 (stable on re-run). fullsend.md: record the new GitHub pins, mark the guard rule satisfied, update the Prerequisites CLI note, and fix the pin-and-bump process (vendor input diff, lock with a CLI at the new commit, pre-merge live check via a temporary pull_request workflow copy). Implements TC-6936 Assisted-by: Claude Code Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Reviewer's GuideThis PR migrates GitHub verify-pr from the old CLI and reusable-dispatch pins to the supported fullsend commit, re-resolves both harnesses and their lockfile with that CLI, and adds documentation plus a temporary same-repository pull_request proof workflow to validate the new pins before merge. Sequence diagram for pre-merge verify-pr pin validationsequenceDiagram
actor Contributor
participant GitHub
participant Proof as Temporary pull_request workflow
participant Fullsend as Fullsend dispatch 9f188578
participant CLI as Fullsend CLI 9f188578
participant Harness as Locked verify-pr harness
Contributor->>GitHub: Push bump PR
GitHub->>Proof: Trigger pull_request
Proof->>Proof: Wait for checks and commit statuses
Proof->>Fullsend: Dispatch with matrix and pinned inputs
Fullsend->>CLI: Build and run pinned CLI
CLI->>Harness: Execute verify-pr
Harness-->>GitHub: Post verification report
Harness-->>Contributor: Report result
Flow diagram for synchronized Fullsend pin and harness lock updateflowchart TD
Start[Update supported Fullsend commit]
Pins[Set uses:@ and fullsend_version to 9f188578]
Vendor[Diff reusable-dispatch inputs secrets and permissions]
Bases[Re-pin verify-pr and triage-security bases to 0bcdff92]
Lock[Run fullsend lock with CLI 9f188578]
Stable{Second lock unchanged?}
Proof[Run temporary pull_request proof]
Merge[Record evidence and merge with merge commit]
Start --> Pins --> Vendor --> Bases --> Lock --> Stable
Stable -->|Yes| Proof
Stable -->|No| Lock
Proof --> Merge
File-Level Changes
Tips and commandsInteracting with Sourcery
Customizing Your ExperienceAccess your dashboard to:
Getting Help
|
![sourcery-ai[bot]](https://avatars.githubusercontent.com/in/48477?s=60&v=4){kind=small}
There was a problem hiding this comment.
Hey - I've found 1 issue
Prompt for AI Agents
Please address the comments from this code review:
## Individual Comments
### Comment 1
<location path=".github/workflows/tc6936-verify-pr-proof.yml" line_range="17" />
<code_context>
+ branches: [main]
+
+concurrency:
+ group: tc6936-verify-pr-proof-${{ github.event.pull_request.number }}
+ cancel-in-progress: true
+
</code_context>
<issue_to_address>
**Parallel reviews duplicate Jira tasks**
When both workflows dispatch for the same PR and their reviews independently propose the same Jira follow-up task, both dispatches can read the same existing sub-task list and emit `create_subtask`; `execute-actions.py` then creates each action without deduplicating against the other run, so Jira receives duplicate follow-up issues.
Prevent both workflows from performing Jira entity-creation actions for the same PR at once, or make those actions idempotent in Jira.
</issue_to_address>Sourcery assessment
Needs a human reviewer. 1 finding to address first, and the new pins and temporary pull-request workflow run the verifier through a dispatch that has GitHub write permissions and Jira credentials; if the updated harness or dispatch behaves incorrectly, it could post reports or make Jira changes. Reverting stops future runs but does not undo comments or Jira updates already made.
Blocking findings: .github/workflows/tc6936-verify-pr-proof.yml:17
|
🤖 Finished Verify Pr · ✅ Success · Started 6:05 PM UTC · Completed 6:16 PM UTC Commit: Runtime: claude · Model: claude-opus-4-8 · Effort: high · Cost: $6.43 |
|
[sdlc-workflow/verify-pr] Re: @sourcery-ai[bot] review — Classified as code change request — the review's single finding (parallel reviews duplicate Jira tasks) is tracked by sub-task TC-7238. The accompanying "needs a human reviewer" assessment is advisory; this skill does not auto-merge — merge remains a human decision. |
Verification Report for TC-6936 (commit 6183cf8)
Overall: WARNOne reviewer code-change request — duplicate Jira follow-ups from parallel/retried verify-pr dispatches ( This comment was AI-generated by sdlc-workflow/verify-pr v0.13.10. |
…ncurrency The main pull_request_target copy does not post a second report: its harness-run job shares reusable-dispatch's concurrency group with the temporary copy and is cancelled. Implements TC-6936 Assisted-by: Claude Code Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
|
🤖 Finished Verify Pr · ⏭️ Skipped (TC-6936 is in status 'In Progress', not 'Review') · Started 6:21 PM UTC · Completed 6:21 PM UTC Commit: Effort: high |
Summary
v0.43.0and reusable-dispatch@d5f36921to the supported fullsend commit9f188578(uses:@andfullsend_versionpinned together; the commit is untagged, so the vendor action builds the CLI from source).install_modeinput, which is ignored at9f188578(installations are always per-repo). Inputs, secrets and the nested-job permission union are otherwise unchanged (reviewed by diffingreusable-dispatch.ymlbetween the two commits).verify-pr,triage-security) to main merge commit0bcdff92and regenerates.fullsend/lock.yamlwith a CLI built at9f188578. A second lock run leaves it unchanged.fullsend.md: new GitHub pins, guard rule marked satisfied for9f188578, Prerequisites CLI note, and fixes to the pin-and-bump process: diffing the vendor workflow, locking with a CLI at the new commit, and a pre-merge live check via a temporarypull_requestcopy of the workflow.6183cf83adds.github/workflows/tc6936-verify-pr-proof.yml, a copy of the workflow triggered onpull_request. It exists so the new pins run verify-pr against this PR before merge. Thepull_request_targetcopy onmainkeeps running the old pins and will post its own report, which is expected. The commit gets force-pushed away once the live evidence is recorded.Merge with a merge commit (never squash or rebase).
Implements TC-6936
🤖 Generated with Claude Code
Summary by Sourcery
Align Fullsend CI and locked harness dependencies with the supported commit, and update the operational guidance for safely maintaining and validating those pins.
Enhancements:
CI:
Documentation: