fix(#7014): add GraphQL endpoint to scaffold GitHub RO profile - #7016
fix(#7014): add GraphQL endpoint to scaffold GitHub RO profile#7016fullsend-ai-coder[bot] wants to merge 2 commits into
Conversation
The scaffold fullsend-github-ro.yaml profile was missing a GraphQL endpoint for api.github.com, while the fleet copy in fullsend-ai/agents included one. This caused agents generated via `fullsend agent new` to fail on any `gh` command using GraphQL (--json, pr view, issue view) with an egress policy denial. Add the missing GraphQL endpoint block and a test that pins the endpoint presence and configuration to catch future scaffold-fleet drift, following the same pattern as #6971 and #6981. Note: pre-commit hooks were not run via pre-commit (infrastructure failure: network-restricted sandbox). Hooks were run directly: gofmt, go vet, check-yaml, trailing-whitespace, end-of-file all passed. Closes #7014
|
🤖 Finished Review · ✅ Success · Started 4:08 PM UTC · Completed 4:27 PM UTC Commit: Runtime: claude · Model: opus → claude-opus-4-6 · Effort: high · Cost: $4.76 |
Codecov Report✅ All modified and coverable lines are covered by tests. 📢 Thoughts on this report? Let us know! |
|
Risk Assessment: low (1/5) DetailsMinimal, well-scoped bug fix adding a missing GraphQL endpoint to the scaffold GitHub RO profile with matching test. Two files changed, 44 lines, perfect test ratio, no protected or security-sensitive paths touched, bot author. Previous runRisk Assessment: low (1/5) DetailsMinimal, well-scoped bug fix adding a missing GraphQL endpoint to a scaffold profile with a matching test. Two files changed, 41 lines, perfect test ratio, no protected or sensitive paths touched. |
ReviewFindingsLow
Previous runReviewFindingsLow
Next steps:
|
![fullsend-ai-review[bot]](https://avatars.githubusercontent.com/in/3478501?s=60&v=4){kind=small}
This comment was marked as outdated.
This comment was marked as outdated.
Sorry, something went wrong.
|
🤖 Finished Fix · ✅ Success · Started 4:29 PM UTC · Completed 4:36 PM UTC Commit: Runtime: claude · Model: opus → claude-opus-4-6 · Effort: high · Cost: $1.10 |
Add Enforcement field to the test struct and assert it equals "enforce", ensuring future changes to the enforcement value are caught by the test. Addresses #7016
🔧 Fix agent — iteration 1 (bot-triggered)Addressed test-adequacy finding by adding Enforcement field assertion to the GraphQL endpoint test. Disagreed with fail-open-risk finding as it requests operational gateway verification outside this PR's scope. Fixed (1):
Disagreed (1):
Tests: passed Decision points
Next steps:
|
|
🤖 Finished Review · ✅ Success · Started 4:38 PM UTC · Completed 4:51 PM UTC Commit: Runtime: claude · Model: opus → claude-opus-4-6 · Effort: high · Cost: $2.28 |
Superseded by updated review
fullsend-ai-review
Bot
added
the
ready-for-merge
1 participant
Summary
Add the missing GraphQL endpoint to the scaffold
fullsend-github-ro.yamlprofile, matching the fleet copy infullsend-ai/agents. Without this endpoint, every agent generated viafullsend agent newis blocked at egress ongh --json,gh pr view,gh issue view, and anything else that usesapi.github.com/graphql.Changes
api.github.com:443, protocolgraphql, read-only, path/graphql) tointernal/scaffold/fullsend-repo/profiles/fullsend-github-ro.yamlTestScaffoldGitHubROProfile_GraphQLEndpointtest to pin the endpoint and catch future scaffold-fleet drift, following the same pattern asTestScaffoldVertexProfile_BinaryAllowlist(sandbox: scaffold Vertex profile lacks **/claude.exe, so every 0.40.0-image Claude run fails with policy_denied #6971)Testing
TestScaffoldGitHubROProfile_GraphQLEndpointverifies the GraphQL endpoint is present with correct host, protocol, path, and access levelgo test ./internal/scaffold/...)go vetpassesCloses #7014
Post-script verification
agent/7014-scaffold-graphql-endpoint)fecb2f0809b7843ed188d99f8dba98fc4a0beb55..HEAD)