feat(cli): authenticate mint status against /v1/status with GitHub credentials by fullsend-ai-coder[bot] · Pull Request #7074 · fullsend-ai/fullsend

fullsend-ai-coder · 2026-09-07T11:07:14Z

Summary

Add GitHub-based authentication to fullsend mint status so it can query the mint's /v1/status API endpoint without requiring GCP cloud viewer IAM. When --mint-url (or FULLSEND_MINT_URL) is provided, the command auto-discovers GitHub credentials: trying GitHub Actions OIDC first, then falling back to GH_TOKEN / GITHUB_TOKEN / gh auth token.

Related Issue

Closes #5884

Changes

internal/mintclient/mintclient.go: Add StatusResult, StatusRequest, StatusAuthMethod types, HasOIDCEnv(), QueryStatus(), and callStatus() for authenticated GET /v1/status with OIDC → GitHub token fallback chain
internal/cli/mint.go: Add --mint-url flag and FULLSEND_MINT_URL env var support to mint status; route to new runMintStatusAPI() when mint URL is provided; keep --project GCP path as fallback
internal/mintclient/mintclient_test.go: Add 8 tests covering OIDC path, GitHub token path, OIDC→GitHub fallback, all-methods-fail, no-resolve-func, validation errors, non-401 terminal errors, and HasOIDCEnv
internal/cli/mint_test.go: Add 4 tests for API-based status success/failure, env var resolution, and flag-overrides-project routing; update existing flag and error message tests

Testing

go test -race ./internal/mintclient/ passes
go test -race ./internal/cli/ passes
gofmt, go vet, gitleaks pass on all changed files
Secret scan passes

Checklist

PR title follows Conventional Commits
Tests added for new logic (12 new test functions)
Auth discovery order matches Epic: Configurable auth for mint status API and CLI #5879 spec (OIDC → GitHub token)

Closes #5884

Post-script verification

Branch is not main/master (agent/5884-mint-status-github-auth)
Secret scan passed (gitleaks — 30ed01e3b9fbb775f5629a69cf3e0291b37f9e75..HEAD)
PR body secret scan passed (gitleaks — no-git)

fullsend-ai-review · 2026-09-07T11:09:23Z

🤖 Finished Review · ✅ Success · Started 11:09 AM UTC · Completed 11:27 AM UTC

Commit: 0a123a5 · View workflow run →

Runtime: claude · Model: opus → claude-opus-4-6 · Effort: high · Cost: $6.22

codecov · 2026-09-07T11:12:56Z

Codecov Report

❌ Patch coverage is 78.61635% with 34 lines in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
internal/mintclient/mintclient.go	68.35%	16 Missing and 9 partials ⚠️
internal/cli/mint.go	88.75%	4 Missing and 5 partials ⚠️

📢 Thoughts on this report? Let us know!

fullsend-ai-review · 2026-09-07T11:27:11Z

Risk Assessment: elevated (3/5)

Details

Tier 1 signals unchanged from prior assessment (BLAST=large, PROTECTED_PATH_COUNT=1, TEST_FILE_RATIO=0.18, bot author); Tier 2 continues to show high fix-commit churn (22 commits/30d, 39 fix/reverts/90d) on mint.go/mintclient.go with no reduction; prior score of 3 preserved per re-review anchoring rules despite raw composite of 2.45.

Previous run

Risk Assessment: elevated (3/5)

Details

Tier 1 signals unchanged from prior assessment (BLAST=large, PROTECTED_PATH_COUNT=1, TEST_FILE_RATIO=0.20, bot author); Tier 2 shows high fix-commit churn on mint.go/mintclient.go; Tier 3 well-scoped; prior score of 3 preserved despite lower raw composite (2.23).

Previous run (2)

Risk Assessment: elevated (3/5)

Details

Score raised from prior 2 to 3: PROTECTED_PATH_COUNT is now 1 (prior rationale cited zero protected paths as a key offset), and raw composite (2.53) rounds to elevated; very high fix/revert churn on mint.go/mint_test.go and large blast radius remain primary drivers, partially offset by bot authorship, no security or CI/dependency changes, and tight acceptance-criteria alignment with the well-scoped GitHub auth issue.

Previous run (3)

Risk Assessment: moderate (2/5)

Details

Moderate risk preserved from prior assessment: large blast radius and very high fix-commit churn on mint files remain the primary risk drivers, offset by bot authorship, zero protected or security-sensitive paths, no CI or dependency changes, and tight acceptance-criteria alignment with the well-scoped GitHub auth issue.

Previous run (4)

Risk Assessment: moderate (2/5)

Details

Moderate risk preserved from prior assessment: large blast radius and very high fix-commit churn on mint files remain the primary risk drivers, offset by bot authorship, zero protected or security-sensitive paths, no CI or dependency changes, and tight acceptance-criteria alignment with the well-scoped GitHub auth issue.

Previous run (5)

Risk Assessment: moderate (2/5)

Details

Moderate risk preserved from prior assessment: large blast radius and high fix-commit churn on mint.go remain the primary risk drivers, offset by bot authorship, zero protected or security-sensitive paths, no CI or dependency changes, and full acceptance-criteria alignment with the well-scoped GitHub auth issue.

Previous run (6)

Risk Assessment: moderate (2/5)

Details

Moderate risk unchanged from prior assessment: large blast radius from new mintclient package and high fix/revert churn on mint.go remain, offset by bot authorship, no security-sensitive or protected paths, and full acceptance-criteria coverage of the well-scoped GitHub auth issue.

Previous run (7)

Risk Assessment: moderate (2/5)

Details

Moderate risk driven primarily by a large blast radius from the new mintclient package and high fix/revert churn on mint.go, substantially offset by a 0.50 test-file ratio, bot authorship, no security-sensitive files, and a clearly scoped issue with a safe fallback auth chain.

fullsend-ai-review · 2026-09-07T11:27:13Z

Review

Findings

Medium

[protected-path] skills/mint-enroll/SKILL.md — This PR modifies a file under a protected path (skills/). The change adds API-based mode documentation to the mint enrollment skill, aligning with issue cli: mint status GitHub auth against /v1/status #5884. Human approval is always required for protected-path changes, regardless of context.

Low

[Naming conventions] internal/cli/mint.go:2096 — runMintStatusAPI has a two-line doc comment, but every sibling runMint* runner function in the same file (runMintDeployGCP, runMintDeployCloudflare, runMintEnrollOrg, runMintEnrollRepo, runMintUnenrollOrg, runMintUnenrollRepo, runMintStatus) has none. The file's established sub-pattern is: helper/utility unexported functions get doc comments; command-runner functions do not.
Remediation: Remove the doc comment from runMintStatusAPI to match the pattern, or alternatively add doc comments to all sibling runMint* runner functions — but the lighter fix is removal.

Next steps:

/fs-fix — agent addresses review findings automatically
/fs-fix <your instruction> — agent fixes with your specific guidance
Push commits directly — review re-runs automatically on push
/fs-fix-stop — disable automatic fix runs for this PR

Previous run

Review

Findings

Medium

[CLI behavioral change] internal/cli/mint.go:1793 — When FULLSEND_MINT_URL is set in the environment and the user passes --project, the command emits a StepWarn and routes to the API-based path with exit 0. The warning is present but written via the printer (stdout) rather than stderr, so log-scraping CI pipelines that parse stdout may confuse the warning with status output. CI pipelines that inherit FULLSEND_MINT_URL from a shared environment and call mint status --project=... will receive API-based output instead of the expected GCP-based output. See also: [New environment variable consumption] finding at this location.
Remediation: Emit the StepWarn to stderr rather than stdout so log-scraping pipelines can distinguish it from status output, or treat the combination of explicit --project with FULLSEND_MINT_URL as a hard error.
[stale-api-reference] docs/guides/infrastructure/infrastructure-reference.md:239 — The Status Endpoint section shows example JSON responses for GET /v1/status that include only org, allowed_orgs, and roles fields. The PR adds a StatusResult struct that also captures workflow_host_repos, version, and commit, and the new mint status --mint-url command displays them. Developers building /v1/status clients from this reference will not know these fields exist.
Remediation: Update the OIDC and non-OIDC example JSON blocks to include workflow_host_repos, version, and commit fields.
[protected-path] skills/mint-enroll/SKILL.md — This PR modifies a file under a protected path (skills/). The change adds API-based mode documentation to the mint enrollment skill, aligning with issue cli: mint status GitHub auth against /v1/status #5884. Human approval is always required for protected-path changes, regardless of context.

Low

[test-adequacy] internal/cli/mint_test.go — No test covers the --mint-url="" escape hatch documented in the warning message at mint.go:1794. The warning tells users to pass --mint-url="" to use GCP-based mode when FULLSEND_MINT_URL is set. While the implementation is correct (the cmd.Flags().Changed guard handles this), there is no regression test for this scenario.
Remediation: Add a test that sets FULLSEND_MINT_URL, passes --mint-url="" --project=<fake>, stubs the GCF client, and asserts the command routes to the GCP-based path.
[New environment variable consumption] internal/cli/mint.go:1787 — mint status now reads FULLSEND_MINT_URL from the environment and, when set, switches the command's execution mode from GCP to API-based. The env var is documented in the --mint-url flag help and the Long description but not in the Short description. See also: [CLI behavioral change] finding at this location.
Remediation: Mention FULLSEND_MINT_URL in the command's Short description so users discover the env var without reading flag help.
[Naming conventions] internal/cli/mint.go:1741 — The comment for mintStatusResolveToken uses "is the function used to resolve" phrasing, inconsistent with the active-verb style used by sibling vars (e.g., mintGCFClientFactory creates GCF clients...).
Remediation: Change to: // mintStatusResolveToken resolves a GitHub token for API-based status queries. Overridden in tests.
[Naming conventions] internal/mintclient/mintclient_test.go:951 — Test_hasOIDCEnv uses the leading-underscore convention while all 25 other tests in the file use TestSubject_Scenario (e.g., TestMintToken_HappyPath, TestQueryStatus_OIDCPath).
Remediation: Rename to TestHasOIDCEnv for consistency with the file's established pattern.
[documentation-coherence] docs/guides/infrastructure/mint-administration.md:423 — The "What status reports" note says API-based mode fields are "documented in the API-based mode section above," but that section describes authentication mechanics and code examples without enumerating the StatusResult fields. The cross-reference points nowhere.
Remediation: Add a sub-section within "API-based mode (recommended)" listing each StatusResult field, or reword the note to remove the dangling cross-reference.

Next steps:

/fs-fix — agent addresses review findings automatically
/fs-fix <your instruction> — agent fixes with your specific guidance
Push commits directly — review re-runs automatically on push
/fs-fix-stop — disable automatic fix runs for this PR

Previous run (2)

Review

Findings

Medium

[edge-case] internal/cli/mint.go:1782 — The --mint-url="" workaround documented in the warning message on line 1790 does not function as described. When a user passes --mint-url="" to force GCP-based mode while FULLSEND_MINT_URL is set, the code at line 1782 checks if mintURL == "" which is true (the flag value is the empty string), so it falls through to read the env var. The env var populates mintURL, and the command routes to API-based mode instead of the user's intended GCP-based mode. The warning text says "pass --mint-url="" to use GCP-based mode" but this path is unreachable.
Remediation: Guard the env-var fallback with cmd.Flags().Changed("mint-url") so an explicit empty flag value is respected. Add a test case: set FULLSEND_MINT_URL, pass --mint-url="" and --project=<valid>, and assert the command routes to the GCP-based path.
[protected-path] skills/mint-enroll/SKILL.md — This PR modifies a file under a protected path (skills/). The change adds API-based mode documentation to the mint enrollment skill, aligning with issue cli: mint status GitHub auth against /v1/status #5884. Human approval is always required for protected-path changes, regardless of context.

Low

[API shape patterns] internal/cli/mint.go:1790 — The warning about --project being ignored is written directly to os.Stderr via fmt.Fprintf instead of going through the ui.Printer abstraction that the rest of the function uses. Writing warnings to stderr is standard practice, but the inconsistency with the surrounding code's output pattern is notable.
Remediation: Create the printer at the top of RunE rather than inline inside the mintURL branch, then emit the warning through printer.StepWarn or an equivalent method.
[Naming conventions] internal/mintclient/mintclient.go:300 — HasOIDCEnv is exported from an internal package but is only called from within the same package (by QueryStatus). No external caller exists. Exporting it widens the package surface without a clear consumer.
Remediation: Unexport as hasOIDCEnv. If it must remain exported for future callers, add a doc comment explaining why.
[Code organization] internal/mintclient/mintclient.go:273 — StatusResult.Roles is the only field in the struct that lacks omitempty, creating a silent inconsistency with the surrounding fields. Likely intentional given the display code explicitly handles empty roles, but the intent is undocumented.
Remediation: Either add omitempty to match the other fields, or add a comment explaining why it is intentionally absent.

Next steps:

/fs-fix — agent addresses review findings automatically
/fs-fix <your instruction> — agent fixes with your specific guidance
Push commits directly — review re-runs automatically on push
/fs-fix-stop — disable automatic fix runs for this PR

Previous run (3)

Review

Findings

Low

[edge-case] internal/cli/mint.go:1782 — When FULLSEND_MINT_URL is set in the environment, an explicitly provided --project flag is silently ignored without any warning. A user who runs fullsend mint status --project=my-project intending GCP-based mode will get API-based mode instead if they have FULLSEND_MINT_URL set (e.g., from a prior session or shell profile). The env-var fallback on line 1782 runs unconditionally when --mint-url is not provided, and the resolved mintURL then takes priority over --project on line 1786. The command's Long help text documents this precedence, but the silent override of an explicit flag by a possibly-forgotten env var is surprising. For comparison, the deploy command's warnIrrelevantFlags function warns about unused flags.
Remediation: When --project is explicitly provided (cmd.Flags().Changed("project")) but mintURL was resolved from the env var (not from --mint-url), emit a warning like: WARNING: --project is ignored because FULLSEND_MINT_URL is set; unset the env var or pass --mint-url="" to use GCP-based mode.
[incomplete-doc] skills/mint-enroll/SKILL.md:124 — The 'Pre-check current state' step describes mint status as showing only GCP-based output and all invocation examples use --project. The API-based mode (--mint-url / FULLSEND_MINT_URL) — now fully implemented and described as 'recommended' in updated docs — is not mentioned. SREs following this skill will always use the GCP IAM-dependent path without knowing a simpler alternative exists.
Remediation: In step 2 ('Pre-check current state'), add a note that when FULLSEND_MINT_URL is already configured, the simpler API-based invocation can be used instead: fullsend mint status --mint-url="$FULLSEND_MINT_URL".

Next steps:

/fs-fix — agent addresses review findings automatically
/fs-fix <your instruction> — agent fixes with your specific guidance
Push commits directly — review re-runs automatically on push
/fs-fix-stop — disable automatic fix runs for this PR

Previous run (4)

Review

Findings

Low

[incomplete-doc] skills/mint-enroll/SKILL.md:124 — The 'Pre-check current state' step describes mint status as showing only GCP-based output (Cloud Run revision info, PEM health) and shows only the --project invocation. The new API-based mode (--mint-url / FULLSEND_MINT_URL) is not mentioned as an alternative. A user who has FULLSEND_MINT_URL set but lacks GCP IAM access would not know they can query status without --project.
Remediation: Add a note below the --project example that fullsend mint status --mint-url="$FULLSEND_MINT_URL" provides a GCP-IAM-free alternative, and clarify the different output fields for each mode.
[scope-incomplete] internal/mintclient/mintclient.go:385 — The PR implements OIDC and GH_TOKEN/GITHUB_TOKEN/gh-auth-token credential discovery but does not implement an interactive gh auth login fallback when no credential is found. Issue cli: mint status GitHub auth against /v1/status #5884 explicitly defers this behind a prerequisite: defining where the CLI OAuth application identity comes from and how tokens are stored. The error message directs users to existing mechanisms, so the UX gap is limited. Code is unchanged from the prior review.
[error-handling-idiom] internal/cli/mint.go:1788 — Error message uses a semicolon to join two clauses: "[org] argument is not supported with --mint-url; the API-based path does not accept an org filter". The file's own convention for multi-clause errors uses em dashes. The [org] bracket notation is CLI-usage syntax rather than prose.
Remediation: Replace with a single-clause message, e.g. fmt.Errorf("org argument is not supported with --mint-url").
[code-organization] internal/mintclient/mintclient.go:344 — Section-divider comments use a decorative // --- X --- style (e.g., // --- Attempt 1: OIDC ---) inconsistent with the rest of the file's plain // comment style.
Remediation: Use plain section comments: // Attempt 1: OIDC and // Attempt 2: GitHub user token.

Next steps:

/fs-fix — agent addresses review findings automatically
/fs-fix <your instruction> — agent fixes with your specific guidance
Push commits directly — review re-runs automatically on push
/fs-fix-stop — disable automatic fix runs for this PR

Previous run (5)

Review

Findings

Low

[scope-incomplete] internal/mintclient/mintclient.go:618 — The PR implements OIDC and GH_TOKEN/GITHUB_TOKEN/gh-auth-token credential discovery but does not implement an interactive gh auth login fallback when no credential is found. The error message from resolveToken() already directs users to run gh auth login, so the UX gap is limited to not launching the flow automatically.
Remediation: Consider creating a follow-up issue tracking interactive login. The current error message provides adequate guidance for the common case.
[incomplete command documentation] docs/guides/infrastructure/standalone-mint.md:313 — The 'Verifying the setup' section does not mention the newly available fullsend mint status --mint-url command as a CLI-level verification alternative to the curl health check.
Remediation: Add a subsection under 'Verifying the setup' showing fullsend mint status --mint-url="$FULLSEND_MINT_URL" as a CLI alternative.
[test adequacy] internal/cli/mint_test.go — No test covers the error path where [org] argument is provided together with --mint-url (or FULLSEND_MINT_URL). The guard at mint.go:1787 returns an explicit error in this case, but it has no test exercising it.
Remediation: Add a test like TestMintStatusCmd_OrgNotSupportedWithMintURL that calls newRootCmd() with args ["mint", "status", "acme-org", "--mint-url=https://mint.example.com"], asserts an error, and checks that the error message contains not supported.
[internal consistency] docs/guides/infrastructure/mint-administration.md:421 — The ### What status reports section describes output fields (Cloud Run revision, template divergence, PEM secret drill-down, health summary) that only appear in GCP-based mode. Since this PR adds the two-mode structure immediately above, a reader following API-based instructions would see different output than described.
Remediation: Prefix the section with a note indicating it describes GCP-based (--project) mode output, or add a parallel subsection for API-mode output.

Next steps:

/fs-fix — agent addresses review findings automatically
/fs-fix <your instruction> — agent fixes with your specific guidance
Push commits directly — review re-runs automatically on push
/fs-fix-stop — disable automatic fix runs for this PR

Previous run (6)

Review

Findings

Medium

[incomplete command documentation] docs/guides/getting-started/operations.md:138 — The per-command IAM role breakdown table marks roles/cloudfunctions.viewer and roles/secretmanager.viewer as required for mint status unconditionally. With the new API-based mode (--mint-url / FULLSEND_MINT_URL), no GCP IAM roles are needed at all. The parallel table in mint-administration.md (updated in this PR) already carries a note that IAM roles apply only to --project mode, but this table has no such qualification.
Remediation: Add a footnote clarifying that GCP viewer roles are only required when using --project (GCP-based) mode. The API-based mode requires only valid GitHub credentials.

Low

[test adequacy] internal/cli/mint_test.go:3407 — TestMintStatusCmd_RequiresProjectOrMintURL does not clear the FULLSEND_MINT_URL environment variable. If this variable is set in the host environment, the command takes the API-based path instead of hitting the expected 'missing config' branch. This is the same class of host-env leakage that was fixed in the other new tests but missed here.
Remediation: Add t.Setenv("FULLSEND_MINT_URL", "") at the start of the test.
[internal consistency] docs/cli/mint.md:311 — The prose states that FULLSEND_MINT_URL activates API-based mode only "when neither --mint-url nor --project is provided." However, the code (mint.go:1780-1786) resolves the env var into mintURL when --mint-url is empty, then routes to the API path regardless of --project. A user with FULLSEND_MINT_URL set who runs fullsend mint status --project=... would get API mode, contrary to the prose. The same inaccuracy appears in the long help text at mint.go:1768.
Remediation: Update the prose to say "when --mint-url is not provided" and update the long help text similarly.
[error-handling idioms] internal/mintclient/mintclient.go:432 — fmt.Errorf("%w: status endpoint returned HTTP 401", errUnauthorized) places %w first, reversing the established codebase pattern. Every other fmt.Errorf wrapping call in this file uses fmt.Errorf("context description: %w", err).
Remediation: Change to fmt.Errorf("status endpoint returned HTTP 401: %w", errUnauthorized).

Next steps:

/fs-fix — agent addresses review findings automatically
/fs-fix <your instruction> — agent fixes with your specific guidance
Push commits directly — review re-runs automatically on push
/fs-fix-stop — disable automatic fix runs for this PR

Previous run (7)

Review

Findings

High

[missing flag documentation] docs/cli/mint.md:297 — The mint status CLI reference section documents only the GCP-based mode and shows --project as the sole argument. The new --mint-url flag and API-based mode (triggered by --mint-url or FULLSEND_MINT_URL) are not mentioned anywhere in this section. A reader following this reference would not know about the API-based mode.
Remediation: Add a flags table for mint status documenting --mint-url (with $FULLSEND_MINT_URL default) and --project. Update prose and examples to describe both modes.

Medium

[error handling] internal/mintclient/mintclient.go:394 — isUnauthorizedErr uses fragile string matching (strings.Contains(err.Error(), "unauthorized")) instead of errors.Is. The errUnauthorized sentinel is properly wrapped with %w at line 431, so errors.Is would work. A non-401 error whose message contains "unauthorized" (e.g., a 403 body like {"error": "unauthorized access"}) would be incorrectly classified as a 401, causing auth fallback instead of a terminal error. See also: [naming convention] finding at this location.
Remediation: func isUnauthorizedErr(err error) bool { return errors.Is(err, errUnauthorized) }
[incomplete command documentation] docs/guides/infrastructure/mint-administration.md:382 — The "Checking mint status" section only documents the GCP-based invocation (--project). The new API-based mode using --mint-url or FULLSEND_MINT_URL with auto-discovered GitHub credentials is absent. The IAM roles table also lists GCP viewer roles as the only requirement for mint status, which is now only true for the GCP-based path.
Remediation: Add a sub-section describing the API-based mode. Update the IAM table footnote to clarify GCP roles apply only to --project mode.

Low

[naming convention] internal/mintclient/mintclient.go:454 — errUnauthorized is declared as var errUnauthorized = fmt.Errorf("unauthorized"). Sentinel errors intended for identity comparison with errors.Is are conventionally created with errors.New, not fmt.Errorf. See also: [error handling] finding at this location.
Remediation: var errUnauthorized = errors.New("unauthorized")
[edge case / silent discard] internal/cli/mint.go:1786 — When --mint-url is provided, the positional [org] argument accepted by cobra.MaximumNArgs(1) is silently discarded. A user running fullsend mint status --mint-url=... myorg gets no feedback that myorg has no effect.
Remediation: Add a check: if mintURL != "" and len(args) > 0, return an error or print a warning.
[test adequacy] internal/cli/mint_test.go:3969 — TestRunMintStatusAPI_Success does not guard against OIDC environment variables being set in the host environment. If ACTIONS_ID_TOKEN_REQUEST_URL and ACTIONS_ID_TOKEN_REQUEST_TOKEN are present (e.g., in GitHub Actions with id-token: write), the auth method would be oidc instead of github, causing the assertion to fail.
Remediation: Add t.Setenv("ACTIONS_ID_TOKEN_REQUEST_URL", "") and t.Setenv("ACTIONS_ID_TOKEN_REQUEST_TOKEN", "") at the start of the test and similar tests.
[stale command tree] docs/guides/dev/cli-internals.md:24 — The CLI command tree entry for mint status lists no flags, whereas sibling commands like mint token list all their flags inline. The new --mint-url flag changes the operational mode.
Remediation: Add --mint-url, --project, and --region flag entries under mint status in the command tree.

Next steps:

/fs-fix — agent addresses review findings automatically
/fs-fix <your instruction> — agent fixes with your specific guidance
Push commits directly — review re-runs automatically on push
/fs-fix-stop — disable automatic fix runs for this PR

fullsend-ai-coder · 2026-09-07T11:29:18Z

🤖 Finished Fix · ✅ Success · Started 11:29 AM UTC · Completed 11:39 AM UTC

Commit: 0a123a5 · View workflow run →

Runtime: claude · Model: opus → claude-opus-4-6 · Effort: high · Cost: $1.68

fullsend-ai-coder · 2026-09-07T11:39:39Z

🔧 Fix agent — iteration 1 (bot-triggered)

Addressed all 7 review findings: fixed error sentinel to use errors.New/errors.Is, added org-argument validation for --mint-url mode, guarded OIDC env vars in tests, and documented the new --mint-url flag across CLI reference, administration guide, and CLI internals command tree

Fixed (7):

missing flag documentation (docs/cli/mint.md): Added --mint-url flag documentation, API-based mode section with examples, and a flags table covering --mint-url, --project, and --region to the mint status CLI reference
error handling (internal/mintclient/mintclient.go): Replaced fragile strings.Contains check in isUnauthorizedErr with errors.Is for proper sentinel error identity comparison
incomplete command documentation (docs/guides/infrastructure/mint-administration.md): Added API-based mode sub-section with auth discovery order, examples, and a note clarifying IAM roles apply only to --project mode
naming convention (internal/mintclient/mintclient.go): Changed errUnauthorized from fmt.Errorf to errors.New per Go sentinel error convention
edge case / silent discard (internal/cli/mint.go): Added error when [org] positional argument is provided with --mint-url, since the API-based path does not support org filtering
test adequacy (internal/cli/mint_test.go): Added t.Setenv calls to clear ACTIONS_ID_TOKEN_REQUEST_URL and ACTIONS_ID_TOKEN_REQUEST_TOKEN in TestRunMintStatusAPI_Success, TestRunMintStatusAPI_AuthFailure, TestMintStatusCmd_MintURLFromEnv, and TestMintStatusCmd_MintURLFlagOverridesProject
stale command tree (docs/guides/dev/cli-internals.md): Added --mint-url, --project, and --region flag entries under mint status in the CLI command tree

Tests: passed

Decision points

Combined errUnauthorized sentinel fix (errors.New) with isUnauthorizedErr fix (errors.Is) as related root cause (alternatives: Fix each independently, Fix together as related sentinel error pattern; rationale: Both findings target the same sentinel error pattern; fixing together ensures consistency)

Next steps:

/fs-review — request a re-review of the changes
/fs-fix <your instruction> — run another fix pass with specific guidance
Push commits directly — review re-runs automatically on push
_{Updated by fullsend fix agent}

- Use errors.New for errUnauthorized sentinel and errors.Is for identity checks instead of fragile string matching - Reject [org] argument when --mint-url is provided instead of silently discarding it - Guard OIDC env vars in mint status API tests to prevent flakes in GitHub Actions environments - Document --mint-url flag and API-based mode in CLI reference, mint administration guide, and CLI internals command tree Addresses #7074

fullsend-ai-review · 2026-09-07T11:41:25Z

🤖 Review · ❌ Terminated · Started 11:41 AM UTC · Ended 11:57 AM UTC

Commit: 245baee · View workflow run →

github-actions · 2026-09-07T11:43:06Z

Site preview

Preview: https://b601e6d7-site.fullsend-ai.workers.dev

Commit: 5f237a26305e1475111f5aa3ae19747a2aba1fc9

fullsend-ai-review · 2026-09-07T11:57:25Z

🤖 Finished Review · ✅ Success · Started 11:41 AM UTC · Completed 11:57 AM UTC

Commit: 245baee · View workflow run →

Runtime: claude · Model: opus → claude-opus-4-6 · Effort: high · Cost: $6.68

fullsend-ai-coder · 2026-09-07T11:59:21Z

🤖 Finished Fix · ✅ Success · Started 11:59 AM UTC · Completed 12:09 PM UTC

Commit: 245baee · View workflow run →

Runtime: claude · Model: opus → claude-opus-4-6 · Effort: high · Cost: $1.67

fullsend-ai-coder · 2026-09-07T12:09:10Z

🔧 Fix agent — iteration 2 (bot-triggered)

Addressed all 4 review findings: added IAM footnote for mint status GCP-only roles in operations.md, cleared FULLSEND_MINT_URL env var in test, fixed internal consistency between docs and code about env var behavior, and corrected fmt.Errorf wrapping order in callStatus

Fixed (4):

incomplete command documentation (docs/guides/getting-started/operations.md): Added footnote markers (x‡) to the mint status column for roles/cloudfunctions.viewer and roles/secretmanager.viewer, with a footnote clarifying that GCP viewer roles are only required when using --project (GCP-based) mode
test adequacy (internal/cli/mint_test.go): Added t.Setenv("FULLSEND_MINT_URL", "") at the start of TestMintStatusCmd_RequiresProjectOrMintURL to prevent host-env leakage
internal consistency (docs/cli/mint.md): Updated prose to say 'when --mint-url is not provided' instead of 'when neither --mint-url nor --project is provided', matching the actual code behavior where env var activates API mode regardless of --project. Also updated the long help text in internal/cli/mint.go similarly
error-handling idioms (internal/mintclient/mintclient.go): Reordered fmt.Errorf wrapping from '%w: context' to 'context: %w' to match the established codebase pattern

Tests: passed

Decision points

The review body note about errUnauthorized naming convention (errors.New vs fmt.Errorf) was already fixed in iteration 1 (alternatives: Fix it again, Skip since already fixed; rationale: Line 391 already shows errors.New('unauthorized') from the iteration 1 fix; no action needed)

Next steps:

/fs-review — request a re-review of the changes
/fs-fix <your instruction> — run another fix pass with specific guidance
Push commits directly — review re-runs automatically on push
_{Updated by fullsend fix agent}

- Add IAM footnote to operations.md clarifying GCP viewer roles for mint status apply only in --project mode - Clear FULLSEND_MINT_URL env var in TestMintStatusCmd_RequiresProjectOrMintURL to prevent host-env leakage - Fix prose in docs/cli/mint.md and mint.go long help text: env var activates API mode when --mint-url is not provided (regardless of --project), not only when neither flag is provided - Fix fmt.Errorf wrapping order in callStatus to match codebase convention (context first, then %w) Addresses #7074

fullsend-ai-review · 2026-09-07T12:11:04Z

🤖 Finished Review · ✅ Success · Started 12:11 PM UTC · Completed 12:29 PM UTC

Commit: 9a08259 · View workflow run →

Runtime: claude · Model: opus → claude-opus-4-6 · Effort: high · Cost: $7.30

fullsend-ai-coder · 2026-09-07T12:31:32Z

🤖 Finished Fix · ✅ Success · Started 12:31 PM UTC · Completed 12:41 PM UTC

Commit: 9a08259 · View workflow run →

Runtime: claude · Model: opus → claude-opus-4-6 · Effort: high · Cost: $1.83

fullsend-ai-coder · 2026-09-07T12:41:22Z

🔧 Fix agent — iteration 3 (bot-triggered)

Addressed 3 of 4 review findings with fixes: added CLI verification docs to standalone-mint.md, added org+mint-url error test, and added GCP-mode clarification to mint-administration.md. Disagreed with scope-incomplete finding (interactive login) as the remediation suggests a follow-up issue, which is out of scope.

Fixed (3):

incomplete command documentation: standalone-mint.md Verifying the setup missing mint status --mint-url (docs/guides/infrastructure/standalone-mint.md): Added a 'Check status via the CLI' subsection under 'Verifying the setup' showing fullsend mint status --mint-url as a CLI-level verification alternative to the curl health check.
test adequacy: no test for [org] argument with --mint-url error path (internal/cli/mint_test.go): Added TestMintStatusCmd_OrgNotSupportedWithMintURL that calls newRootCmd() with args ['mint', 'status', 'acme-org', '--mint-url=https://mint.example.com'], asserts an error, and checks the error message contains 'not supported'.
internal consistency: What status reports section describes GCP-only output without indicating it (docs/guides/infrastructure/mint-administration.md): Added a blockquote note at the top of 'What status reports' clarifying that the fields below are reported by --project (GCP-based) mode, and that API-based mode returns a different payload.

Disagreed (1):

scope-incomplete: no interactive gh auth login fallback: The remediation explicitly suggests creating a follow-up issue, which is out of scope for this fix agent. The existing error message already directs users to run gh auth login, providing adequate UX guidance.

Tests: passed

Decision points

Disagree with scope-incomplete finding about interactive gh auth login (alternatives: Create a follow-up issue for interactive login, Record disagreement since creating issues is out of scope; rationale: The fix agent cannot create GitHub issues, and the finding's own remediation says 'consider creating a follow-up issue' — this is a suggestion for the PR author, not a code change.)

Next steps:

/fs-review — request a re-review of the changes
/fs-fix <your instruction> — run another fix pass with specific guidance
Push commits directly — review re-runs automatically on push
_{Updated by fullsend fix agent}

fullsend-ai-coder · 2026-09-07T13:35:29Z

🤖 Finished Fix · ✅ Success · Started 1:35 PM UTC · Completed 1:46 PM UTC

Commit: d8a728c · View workflow run →

Runtime: claude · Model: opus → claude-opus-4-6 · Effort: high · Cost: $1.98

fullsend-ai-coder · 2026-09-07T13:46:29Z

🔧 Fix agent — iteration 5 (bot-triggered)

Addressed both review findings. Added a warning when --project is silently ignored due to FULLSEND_MINT_URL env var, following the existing warnIrrelevantFlags pattern. Updated the mint-enroll skill to document the API-based mode alternative.

Fixed (2):

When FULLSEND_MINT_URL is set, --project is silently ignored without warning (internal/cli/mint.go): Added a warning to stderr when --project is explicitly provided but mintURL was resolved from the FULLSEND_MINT_URL env var (not from --mint-url flag). Uses cmd.Flags().Changed("project") and fmt.Fprintf(os.Stderr, ...) consistent with the existing warnIrrelevantFlags pattern. Added TestMintStatusCmd_EnvURLWarnsIgnoredProject to verify the code path.
The mint-enroll skill's Pre-check current state step does not mention API-based mode (skills/mint-enroll/SKILL.md): Added a note in step 2 (Pre-check current state) that when FULLSEND_MINT_URL is already configured, the simpler API-based invocation can be used instead, with a code example. The existing GCP-based example is preserved under an 'Otherwise' label.

Tests: passed

Strategy change: Prior iterations (3 and 4) addressed only style findings (error message formatting, comment style) and consistently missed the two substantive findings. This iteration directly addresses both core concerns: the edge-case warning and the SKILL.md documentation gap.

Decision points

Use fmt.Fprintf(os.Stderr, ...) vs cmd.PrintErrf for warning output (alternatives: fmt.Fprintf(os.Stderr, ...) consistent with warnIrrelevantFlags, cmd.PrintErrf() for easier test capture; rationale: Chose os.Stderr for consistency with the existing warnIrrelevantFlags pattern at line 689. The new test verifies the functional behavior (API path is taken) rather than capturing stderr text.)

Next steps:

/fs-review — request a re-review of the changes
/fs-fix <your instruction> — run another fix pass with specific guidance
Push commits directly — review re-runs automatically on push
_{Updated by fullsend fix agent}

… var When FULLSEND_MINT_URL is set in the environment and the user explicitly passes --project, the command now emits a warning to stderr explaining that --project is ignored and how to use GCP-based mode instead. This follows the warnIrrelevantFlags pattern used by mint deploy. Also adds API-based mode documentation to the mint-enroll skill's pre-check step so SREs know the simpler invocation is available. Note: pre-commit hooks were not run. pre-commit could not complete (infrastructure failure), and the direct-execution fallback was used for gofmt/go vet. Addresses #7074

fullsend-ai-review · 2026-09-07T13:48:16Z

🤖 Finished Review · ✅ Success · Started 1:48 PM UTC · Completed 2:06 PM UTC

Commit: 5f237a2 · View workflow run →

Runtime: claude · Model: opus → claude-opus-4-6 · Effort: high · Cost: $5.25

fullsend-ai-coder · 2026-09-07T14:09:23Z

🤖 Finished Fix · ❌ Failure (running pre-script: exit status 1) · Started 2:09 PM UTC · Completed 2:09 PM UTC

Commit: 5f237a2 · View workflow run →

Effort: high

ifireball · 2026-09-08T03:59:28Z

/fs-fix rebase and squash commits, fix outstanding review issues

fullsend-ai-coder · 2026-09-08T04:01:13Z

🤖 Finished Fix · ✅ Success · Started 4:01 AM UTC · Completed 4:15 AM UTC

Commit: 5f237a2 · View workflow run →

Runtime: claude · Model: opus → claude-opus-4-6 · Effort: high · Cost: $2.87

…edentials Add GitHub-based authentication to fullsend mint status so it can query the mint /v1/status API endpoint without requiring GCP cloud viewer IAM. When --mint-url (or FULLSEND_MINT_URL) is provided, the command auto-discovers GitHub credentials: trying GitHub Actions OIDC first, then falling back to GH_TOKEN / GITHUB_TOKEN / gh auth token. Changes: - Add StatusResult, StatusRequest, StatusAuthMethod types, hasOIDCEnv, QueryStatus, and callStatus in internal/mintclient for authenticated GET /v1/status with OIDC to GitHub token fallback chain - Add --mint-url flag and FULLSEND_MINT_URL env var support to mint status; route to runMintStatusAPI when mint URL is provided - Guard env-var fallback with cmd.Flags.Changed so --mint-url can force GCP mode when FULLSEND_MINT_URL is set - Emit --project-ignored warning via ui.Printer.StepWarn not os.Stderr - Add 12 test functions covering auth paths, fallback, validation, env var resolution, and flag-overrides-project routing - Update docs: cli/mint.md, cli-internals.md, operations.md, mint-administration.md, standalone-mint.md, and mint-enroll skill Closes #5884 Addresses #7074

fullsend-ai-coder · 2026-09-08T04:15:23Z

🔧 Fix agent — iteration 6 (human-triggered)

Fixed 5 outstanding review findings (--mint-url="" escape hatch, StepWarn for warnings, unexport hasOIDCEnv, omitempty on Roles, section divider style) and squashed 6 commits into a single clean feat(cli) commit per human instruction. The gh auth login fallback suggestion is out of scope per the issue spec.

Fixed (6):

--mint-url="" escape hatch does not work when FULLSEND_MINT_URL is set (internal/cli/mint.go): Guard env-var fallback with cmd.Flags().Changed("mint-url") so an explicit --mint-url="" skips the FULLSEND_MINT_URL env-var lookup, allowing users to force GCP-based mode
Warning about --project being ignored uses fmt.Fprintf(os.Stderr) instead of ui.Printer (internal/cli/mint.go): Move printer creation to top of RunE and emit the warning via printer.StepWarn instead of fmt.Fprintf(os.Stderr)
HasOIDCEnv is exported but only used within the package (internal/mintclient/mintclient.go): Unexported HasOIDCEnv to hasOIDCEnv since it is only called by QueryStatus within the same package; updated all test references
StatusResult.Roles lacks omitempty, inconsistent with other fields (internal/mintclient/mintclient.go): Added omitempty to the Roles field json tag to match the convention of all other fields in the struct
Section divider comment uses decorative // --- X --- style (internal/mintclient/mintclient_test.go): Changed decorative // --- QueryStatus tests --- to plain // QueryStatus tests to match file conventions
Rebase and squash commits per human instruction: Squashed 6 commits into a single clean feat(cli) commit via git reset --soft to merge base

Disagreed (1):

No interactive gh auth login fallback when no credential is found: Issue cli: mint status GitHub auth against /v1/status #5884 explicitly defers this behind a prerequisite. The current error message already directs users to run gh auth login, providing adequate guidance. This is out of scope for this PR.

Tests: passed

Strategy change: Previous iterations each added incremental fix commits. This iteration (6, above escalation threshold) takes a different approach: fix all remaining issues at once and squash the entire branch into a single clean commit, as explicitly requested by the human reviewer.

Decision points

Squash strategy for 6 commits (alternatives: Squash into single commit, Keep separate feat + fix commits; rationale: Human explicitly requested rebase and squash. A single clean feat commit is cleaner for the PR history and matches the convention for a new feature.)
Use cmd.Flags().Changed vs checking empty string for --mint-url (alternatives: Check mintURL == "" (original), Use cmd.Flags().Changed("mint-url") (chosen); rationale: cmd.Flags().Changed correctly distinguishes between flag-not-provided and flag-provided-as-empty, making the --mint-url="" escape hatch work as documented in the warning message.)

Next steps:

/fs-review — request a re-review of the changes
/fs-fix <your instruction> — run another fix pass with specific guidance
Push commits directly — review re-runs automatically on push
_{Updated by fullsend fix agent}

fullsend-ai-review · 2026-09-08T04:17:15Z

🤖 Finished Review · ✅ Success · Started 4:17 AM UTC · Completed 4:40 AM UTC

Commit: 4f1a563 · View workflow run →

Runtime: claude · Model: opus → claude-opus-4-6 · Effort: high · Cost: $8.69

fullsend-ai-coder · 2026-09-08T04:42:23Z

🤖 Finished Fix · ✅ Success · Started 4:42 AM UTC · Completed 4:55 AM UTC

Commit: 4f1a563 · View workflow run →

Runtime: claude · Model: opus → claude-opus-4-6 · Effort: high · Cost: $3.14

- Emit --project-ignored warning to stderr (matching warnIrrelevantFlags pattern) so CI log-scraping pipelines can distinguish it from status output - Add workflow_host_repos, version, commit to /v1/status JSON examples in infrastructure-reference.md - Add StatusResult field listing to API-based mode section in mint-administration.md and fix dangling cross-reference - Add TestMintStatusCmd_MintURLEmptyEscapeHatch test for --mint-url="" escape hatch when FULLSEND_MINT_URL is set - Mention FULLSEND_MINT_URL in mint status Short description - Fix mintStatusResolveToken comment to active-verb style - Rename Test_hasOIDCEnv to TestHasOIDCEnv for naming consistency Addresses #7074

fullsend-ai-coder · 2026-09-08T04:55:56Z

🔧 Fix agent — iteration 2 (bot-triggered)

Addressed all 8 review findings: fixed 7 (stderr warning, stale API reference, escape hatch test, Short description, comment style, test naming, documentation cross-reference) and recorded 1 disagreement (protected-path acknowledgment requiring human approval).

Fixed (7):

CLI behavioral change: StepWarn writes to stdout instead of stderr (internal/cli/mint.go): Changed warning about --project being ignored to use fmt.Fprintf(os.Stderr, ...) matching the warnIrrelevantFlags pattern at line 689, so CI log-scraping pipelines can distinguish warnings from status output
stale-api-reference: /v1/status JSON examples missing workflow_host_repos, version, commit fields (docs/guides/infrastructure/infrastructure-reference.md): Added workflow_host_repos, version, and commit fields to both OIDC and non-OIDC example JSON blocks in the Status Endpoint section
test-adequacy: No test covers the --mint-url="" escape hatch (internal/cli/mint_test.go): Added TestMintStatusCmd_MintURLEmptyEscapeHatch that sets FULLSEND_MINT_URL, passes --mint-url= --project=test-project, mocks the GCF client, and asserts the command routes to the GCP-based path
New environment variable consumption: FULLSEND_MINT_URL not mentioned in Short description (internal/cli/mint.go): Added '(honors FULLSEND_MINT_URL)' to the command's Short description so users discover the env var without reading flag help
Naming conventions: mintStatusResolveToken comment uses inconsistent phrasing (internal/cli/mint.go): Changed comment to active-verb style: 'mintStatusResolveToken resolves a GitHub token for API-based status queries. Overridden in tests.'
Naming conventions: Test_hasOIDCEnv uses leading-underscore convention (internal/mintclient/mintclient_test.go): Renamed Test_hasOIDCEnv to TestHasOIDCEnv for consistency with the file's TestSubject_Scenario naming convention
documentation-coherence: Cross-reference in 'What status reports' points nowhere (docs/guides/infrastructure/mint-administration.md): Added StatusResult field listing (version, commit, org, allowed_orgs, roles, workflow_host_repos) to the API-based mode section, and updated the cross-reference to use a proper markdown anchor link

Disagreed (1):

protected-path: skills/mint-enroll/SKILL.md modified under protected path: This is a protected-path acknowledgment requiring human approval, not a code fix. The change to skills/mint-enroll/SKILL.md was made in a prior iteration and is aligned with issue cli: mint status GitHub auth against /v1/status #5884. No fix agent action is applicable.

Tests: passed

Decision points

Warning output mechanism: stderr via fmt.Fprintf vs stderr via separate ui.Printer (alternatives: fmt.Fprintf(os.Stderr, ...) matching warnIrrelevantFlags pattern, ui.New(os.Stderr) separate printer for warnings; rationale: The codebase's established pattern for flag-ignored warnings is fmt.Fprintf(os.Stderr, 'WARNING: ...') as seen in warnIrrelevantFlags at line 689. This maintains consistency and avoids creating an extra printer object for a single warning.)

Next steps:

/fs-review — request a re-review of the changes
/fs-fix <your instruction> — run another fix pass with specific guidance
Push commits directly — review re-runs automatically on push
_{Updated by fullsend fix agent}

fullsend-ai-review · 2026-09-08T04:57:52Z

🤖 Finished Review · ✅ Success · Started 4:57 AM UTC · Completed 5:12 AM UTC

Commit: 84355ee · View workflow run →

Runtime: claude · Model: opus → claude-opus-4-6 · Effort: high · Cost: $4.83

fullsend-ai-review

See the review comment for full details.

fullsend-ai-review · 2026-09-08T05:12:39Z

 	return nil
 }

+// runMintStatusAPI queries the mint's /v1/status endpoint using


[low] Naming conventions

runMintStatusAPI has a two-line doc comment, but every sibling runMint* runner function in the same file (runMintDeployGCP, runMintDeployCloudflare, runMintEnrollOrg, runMintEnrollRepo, runMintUnenrollOrg, runMintUnenrollRepo, runMintStatus) has none. The file's established sub-pattern is: helper/utility unexported functions get doc comments; command-runner functions do not.

Suggested fix: Remove the doc comment from runMintStatusAPI to match the pattern, or alternatively add doc comments to all sibling runMint* runner functions — but the lighter fix is removal.

fullsend-ai-coder · 2026-09-08T05:14:24Z

🤖 Finished Fix · ✅ Success · Started 5:14 AM UTC · Completed 5:22 AM UTC

Commit: 84355ee · View workflow run →

Runtime: claude · Model: opus → claude-opus-4-6 · Effort: high · Cost: $1.48

Sibling runMint* runner functions in mint.go do not have doc comments; only helper/utility functions do. Remove the two-line doc comment from runMintStatusAPI to match the established pattern. Note: pre-commit hooks were not run. `pre-commit` could not complete (infrastructure failure: HTTP 403 fetching remote hooks), and the direct-execution fallback was used for go vet and gofmt instead. Addresses #7074

fullsend-ai-coder · 2026-09-08T05:22:17Z

🔧 Fix agent — iteration 3 (bot-triggered)

Removed doc comment from runMintStatusAPI to match file convention where sibling runMint* runner functions have no doc comments. The protected-path finding for skills/mint-enroll/SKILL.md is acknowledged — it requires human approval per policy.

Fixed (1):

Naming conventions: runMintStatusAPI has a doc comment but sibling runMint runner functions do not* (internal/cli/mint.go): Removed the two-line doc comment from runMintStatusAPI to match the file's established pattern where command-runner functions have no doc comments

Disagreed (1):

Protected path: skills/mint-enroll/SKILL.md modified under protected path: This is an informational finding noting that human approval is required for protected-path changes. No code fix is needed — the file was intentionally modified as part of the PR's scope and requires human reviewer approval per policy.

Tests: passed

Decision points

Protected-path finding is informational, not actionable (alternatives: Revert the skills/ change, Leave it for human approval; rationale: The skills/mint-enroll/SKILL.md change is part of the PR's intentional scope (documenting the new API-based mint status mode). Reverting it would remove useful documentation. Human approval is the correct gate.)

Next steps:

/fs-review — request a re-review of the changes
/fs-fix <your instruction> — run another fix pass with specific guidance
Push commits directly — review re-runs automatically on push
_{Updated by fullsend fix agent}

fullsend-ai-review · 2026-09-08T05:24:28Z

🤖 Review · Started 5:24 AM UTC

Commit: dbcc467 · View workflow run →

fullsend-ai-coder Bot requested a review from a team as a code owner September 7, 2026 11:07

fullsend-ai-coder Bot added the ready-for-review Triggers review agent dispatch label Sep 7, 2026

fullsend-ai-coder Bot assigned ifireball Sep 7, 2026

fullsend-ai-coder Bot had a problem deploying to dev September 7, 2026 11:07 Failure

fullsend-ai-review Bot added the risk/moderate PR risk: moderate label Sep 7, 2026