redhat-developer / redhat-developer/rhdh-fullsend

fullsend: allow triage-level users to trigger /fs-review

Open
#32 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
Dockerfile
Stars
2
Forks
7
Avg merge
1d 13h
Merged PRs (30d)
8

Description

Problem

The fullsend reusable dispatch (reusable-dispatch.yml) gates all /fs-review and /fs-fix commands behind has_write_permission, which requires admin, maintain, or write repo access. Users with triage permission cannot trigger agent runs — their commands are silently ignored.

This makes sense for /fs-fix (pushes commits), but /fs-review is read-only analysis that posts a review comment. Requiring write access for a read-only operation is overly restrictive.

Context

Discovered on rhdh-plugin-export-overlays#2778 — a contributor with triage permission commented /fs-review multiple times with no effect, while an admin's identical comment triggered the run immediately.

The repo has 13 users at triage level who cannot trigger reviews, vs 84 users at write+ who can.

Proposed fix

Add a min_permission input to reusable-dispatch.yml (defaulting to write for backwards compatibility) that repos can override in their shim workflow:

# .github/workflows/fullsend.yaml
uses: fullsend-ai/fullsend/.github/workflows/reusable-dispatch.yml@v0
with:
  min_permission: triage   # allow triage users to trigger /fs-review

Or, lower the permission floor for /fs-review specifically (since it's read-only), while keeping write for /fs-fix.

Workaround

Grant the user write access to the repo.

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by reading reusable-dispatch.yml, focusing on the has_write_permission gate for /fs-review and /fs-fix, then inspect the referenced shim workflow example in the issue. Define whether the change uses a configurable permission floor or separate floors by command. Done means triage users can trigger read-only reviews, write access remains required for fixes, and the default preserves existing behavior.

Written by the indexing model from the issue text.

Assessment

Tech stack
github-actions
Domain
ci-cd, security
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
56/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.