redhat-developer / redhat-developer/rhdh-fullsend
fullsend: allow triage-level users to trigger /fs-review
Nobody has claimed this yet.
- Dominant language
- Dockerfile
- Stars
- 2
- Forks
- 7
- Avg merge
- 1d 13h
- Merged PRs (30d)
- 8
Description
Problem
The fullsend reusable dispatch (reusable-dispatch.yml) gates all /fs-review and /fs-fix commands behind has_write_permission, which requires admin, maintain, or write repo access. Users with triage permission cannot trigger agent runs — their commands are silently ignored.
This makes sense for /fs-fix (pushes commits), but /fs-review is read-only analysis that posts a review comment. Requiring write access for a read-only operation is overly restrictive.
Context
Discovered on rhdh-plugin-export-overlays#2778 — a contributor with triage permission commented /fs-review multiple times with no effect, while an admin's identical comment triggered the run immediately.
The repo has 13 users at triage level who cannot trigger reviews, vs 84 users at write+ who can.
Proposed fix
Add a min_permission input to reusable-dispatch.yml (defaulting to write for backwards compatibility) that repos can override in their shim workflow:
# .github/workflows/fullsend.yaml
uses: fullsend-ai/fullsend/.github/workflows/reusable-dispatch.yml@v0
with:
min_permission: triage # allow triage users to trigger /fs-review
Or, lower the permission floor for /fs-review specifically (since it's read-only), while keeping write for /fs-fix.
Workaround
Grant the user write access to the repo.
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reading reusable-dispatch.yml, focusing on the has_write_permission gate for /fs-review and /fs-fix, then inspect the referenced shim workflow example in the issue. Define whether the change uses a configurable permission floor or separate floors by command. Done means triage users can trigger read-only reviews, write access remains required for fixes, and the default preserves existing behavior.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- github-actions
- Domain
- ci-cd, security
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 56/100