chore(deps): bump fullsend from v0.40.0 to v0.43.0 - #88
Conversation
The Fix agent post-run script in v0.40.0 rejects any agent commit that carries a Signed-off-by trailer and discards the commit. v0.42.0 replaced the rejection with an automatic strip, and v0.43.0 keeps that behaviour. Regenerated the harness digest with scripts/renovate/update-fullsend-harness-sha.sh.
|
Important
This repository does not receive automatic reviews because it has fewer than 10 stars. ⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Advanced Run ID: Comment |
|
Risk Assessment: moderate (2/5) DetailsTiny version-bump PR (3 config files, 6 lines) with no code logic changes; elevated sub-scores for CI workflow modification and protected paths are offset by minimal change size, clean git history, and low churn, yielding an overall moderate risk. |
ReviewFindingsHigh
Low
Next steps:
|
![fullsend-ai-review[bot]](https://avatars.githubusercontent.com/in/3478501?s=60&v=4){kind=small}
|
🤖 Finished Review · ✅ Success · Started 11:03 AM UTC · Completed 11:14 AM UTC Commit: Runtime: claude · Model: opus → claude-opus-4-6 · Effort: high · Cost: $2.42 |
Retro: PR #88 — fullsend version bump v0.40.0 → v0.43.0What happenedPR #88 was a human-authored manual dependency bump of fullsend from v0.40.0 to v0.43.0 (3 files, 6 lines — pure SHA/version substitutions). The author overrode Renovate's 10-day stability wait because the Fix agent's post-run script in v0.40.0 was rejecting agent commits carrying The review agent ran at Opus/high effort ($2.42) and produced two findings: a HIGH protected-path finding (PR modifies AssessmentThe workflow worked well. The review agent correctly identified that The main inefficiency is the CHANGES_REQUESTED verdict on a mechanical version bump that the PR body already justified in detail. The review agent did not engage with the PR body's risk assessment, cost analysis, or changelog comparison — it treated the change as an unauthorized governance modification rather than a mechanical dependency update. This added a mandatory human-approval gate that, while not harmful here, represents a false-positive pattern for this class of change. Existing issue coverageAll improvement opportunities identified are already tracked in upstream issues. No new proposals are warranted. Protected-path severity on mechanical version bumps — extensively covered:
This retro provides additional evidence for these issues: the PR body contained a thorough risk assessment, changelog comparison, and explicit documentation that Review efficiency for mechanical dependency bumps — covered by:
Evidence: $2.42 Opus cost for a 6-line SHA-substitution change. Supply-chain visibility for reusable workflows — covered by:
Review harness overlay for this repo — covered by:
Notable observation: agent version splitDuring the review, the triage harness overlay ( |
|
🤖 Finished Retro · ✅ Success · Started 1:55 PM UTC · Completed 2:04 PM UTC Commit: Runtime: claude · Model: opus → claude-opus-4-6 · Effort: high · Cost: $2.30 |
2 participants
What
Bump Fullsend from v0.40.0 to v0.43.0.
.github/workflows/fullsend.yaml—reusable-dispatch.ymlpin.github/workflows/prioritize.yml—reusable-prioritize.ymlpin.fullsend/harness/triage.yaml— harness base URL andsha256digestBoth workflow pins move to the same commit,
d5f3692(v0.43.0). The digest wasregenerated with
scripts/renovate/update-fullsend-harness-sha.sh, not by hand.Why
The post-run script for the Fix agent in v0.40.0 rejects any agent commit that
carries a
Signed-off-bytrailer, and throws that commit away. The agent's workis lost with it.
v0.42.0 replaced the rejection with an automatic strip. The script now removes
the trailer and carries on. v0.43.0 is the latest release and keeps that
behaviour. The strip needs the
GIT_BOT_EMAILvariable, which the dispatchworkflow already sets.
It has failed three times, on two pull requests
That is $8.25 of agent time discarded, and the work along with it. On #81 the
agent had already edited nine files when the check rejected its commit.
It is intermittent, so a prompt reminder is not a control
Eleven Fix runs have run across these two PRs. Eight finished cleanly and three
died on the trailer, every one of them on v0.40.0. On 8 September, PR #41 ran
three clean fixes, then two that failed on the trailer, then another clean one.
Same day, same PR, same version. The only thing that varies is whether the agent
chooses
git commit -s.The agent is already told not to. Its own
fix-reviewskill says, in bold,**NEVER use git commit -s or Signed-off-by.**That line is byte-identical inv0.40.0 and v0.43.0. It signed off anyway.
The retro agent reached the same conclusion on #41 and added it as evidence to
fullsend-ai/agents#552. It
also found that the wording of the fix request changed the outcome: asking to
"resolve merge conflicts" produced the trailer, asking to "rebase this PR" did
not. Wording is not something we can rely on.
The fix has been available for six days
fullsend-ai/agents#1184
landed the automatic strip on 4 September, and it shipped in v0.42.0 on
5 September. We hit the bug on 8 September and again on 10 September, both times
on v0.40.0.
This bump overrides the repository's 10-day Renovate stability wait. The Fix loop
is blocked without it.
Risk
Checked between the two versions:
reusable-prioritize.ymlis byte-identical.reusable-dispatch.ymlchanges only by dropping the/fullsend retroalias./fs-retrostill works, and this repository never used the alias..fullsend/config.yamlis untouched. Every config change between the twoversions is additive, and every key this repository sets is still valid.
Protected paths
The diff touches
.github/, which is on the review bot's protected-paths list,so the bot will not approve it on its own. There is no issue for this bump. It
is a dependency update needed to unblock the Fix agent loop, described above.
Testing
pre-commit run --all-filespasses.3aa32e9f66ad6a9b60a75f50d3adc6ae39ebfb425c3928381e019436498bf2aa.