[dependabot]

Bumps fullsend-ai/fullsend/.github/workflows/reusable-dispatch.yml from 0.48.0 to 0.50.0.

Release notes

Sourced from fullsend-ai/fullsend/.github/workflows/reusable-dispatch.yml's releases.

v0.50.0

Choose when the fleet agents run, from config.yaml. A CEL trigger on the review, retro, triage or prioritize entry in .fullsend/config.yaml now decides when that agent runs on GitHub, in place of the dispatch workflow's built-in rules. For example, to stop the automatic review on every pull request but keep /fs-review on demand:

agents:
  - name: review
    trigger: >-
      event.transition.kind == "comment_added"
      && has(event.entity.linked_change_proposal)
      && has(event.transition.comment.command)
      && event.transition.comment.command == "/fs-review"
      && event.actor.kind == "human"

Repositories without a trigger keep today's behaviour, so nothing changes unless you opt in. The trigger is read from your default branch, so a pull request cannot change its own routing. An invalid trigger makes every agent run in the repository fail with invalid agent config, so check the expression before you merge it. A harness trigger: never changes when a built-in agent runs; copy it into config.yaml to opt in. Triggers for the code and fix agents are coming in a later release. See Choosing when review runs, Choosing when retro runs and Choosing when triage and prioritize run in the customizing-agents guide.

Permission checks on CEL dispatch are now per harness: agents whose harness sets role: triage or role: review can be started by users with triage access, while every other role still needs write. Claude runs now set CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC=1 on every route, including Vertex, a harness with its own ANTHROPIC_BASE_URL and runs with security hooks off; before, only the runner-managed gateway route set it. Nothing for you to change.

On GitLab, fullsend run adds the configured forge host to the attached credential profile, so self-managed hosts work with the stock GitLab providers. fullsend repos install now applies runner tag changes even from a build without a release ref, keeps blank lines when it rewrites .gitlab-ci.yml, and resolves extends: and !reference when it scans trigger jobs. Runner VMs refuse job images that pin OpenShell 0.0.x with a clear error instead of downgrading the host. fullsend agent new now generates agents that read the forge-neutral work item URL.

---

Changelog

Breaking Changes

• 7b1296c5653effe068cf768b3be609f3b16d45b9: test(#8622)!: wire cross-org repo slots into behaviour and playback (@​fullsend-ai-coder[bot])

Features

• 460779dd02880ea2955e0954256057b31d208903: feat(#8413): add GitHub bot-role lookup and behaviour matrix (@​fullsend-ai-coder[bot])
• 3d911f7199e9ddee37557e4be691433deb1567dd: feat(#8724): apply per-harness permission threshold on the CEL path (@​fullsend-ai-coder[bot])
• b4a4b94cd4dbb449ac691d7952b246abe6031b31: feat(#8726): let agents[].trigger decide when review runs (@​fullsend-ai-coder[bot])
• 047dc2922928b56c4464dcc5f7c0b6dc5411e395: feat(#8736): let config triggers route retro, triage and prioritize (@​fullsend-ai-coder[bot])

Bug Fixes

• 7f4a9502b7b30b78a8c997babb0f5f0be194e2c4: fix(#8090): show the reason code in the e2e gate comment (@​gklein)
• 2165590fadbd6a539fba224716a1c43b6ac8dddf: fix(#8648): use work item URL in generated agents (@​Aliciapet11)
• 9604e7fda0ef574ecc80be91fb52f32fd206fd68: fix(#8683): add GitLab forge host to the attached credential profile (@​fullsend-ai-coder[bot])
• 3ae6f0a2ab56a7fab71be30b53c2574ff85a7f6a: fix(#8683): resolve YAML aliases when adding the GitLab forge endpoint (@​fullsend-ai-coder[bot])
• f11f5e56b16aaf2cc9b4d9145e936c9889f6f2e4: fix(#8688): keep blank lines when rewriting .gitlab-ci.yml (@​fullsend-ai-coder[bot])
• 95443c3d0069d55d2d6bfe62e447aec1bd6db630: fix(#8689): converge GitLab runner tags without a resolvable ref (@​fullsend-ai-coder[bot])
• 69c9a0e3ce5a305824f913b1b3caf7c123226ef3: fix(#8689): keep main-marked GitLab scaffolds out of unstamped detection (@​fullsend-ai-coder[bot])
• 401375f5524f9780a7fca4c6649826a81965b7ce: fix(#8691): bound !reference expansion work in GitLab trigger job scan (@​fullsend-ai-coder[bot])
• abd90434578e6d8a27591b80d03062e7e26ba850: fix(#8691): memoize extends resolution in GitLab trigger job scan (@​fullsend-ai-coder[bot])
• ea5ba28ec8d87a43b4c40cf6b4b85ef8f712edfa: fix(#8691): resolve extends and !reference in GitLab trigger job scan (@​fullsend-ai-coder[bot])
• 399b94c5b1ecc0f286e0335d7caa21c9475752b2: fix(#8710): bound GitLab YAML merge-key lookup work (@​fullsend-ai-coder[bot])
• 06dd062973fc1fa486e771f5a77d9309b234b429: fix(#8724): filter harnesses before CEL and align authorization docs (@​waynesun09)
• 484b6532d5ea21b8d05d8a288beea36ce61134eb: fix(#8725): skip built-in agents in GitHub CEL dispatch (@​fullsend-ai-coder[bot])
• 44fdffc56db2b695ca6089ab982168f46834af45: fix(#8726): fail the review route on invalid config, keep harness dispatch triggers (@​waynesun09)
• 55c7c98c7dd12a717ea4c4f50e336e56745fe872: fix(#8726): skip on trigger evaluation errors and harden CEL route steps (@​waynesun09)
• 305a0e00eb13c399e8b9fd25da9bfcce4a7787d4: fix(#8730): refuse pre-0.1 OpenShell job images on GitLab runners (@​fullsend-ai-coder[bot])
• 3b7f1435f698234bc2a2379cc0fdded3e08d14d3: fix(#8736): grant lifecycle close only on the retro route (@​waynesun09)
• 73f8746dafcb3359ddf8bb7f1b0825934ae7e48d: fix(#8750): disable Claude Code nonessential traffic on every route (@​fullsend-ai-coder[bot])

... (truncated)

Commits

• 5163a55 Merge pull request #8752 from fullsend-ai/agent/8750-disable-nonessential-tra...
• 3f45556 Merge pull request #7232 from fullsend-ai/agent/7230-token-cost-telemetry
• 51f7f2f fix(#8750): pin nonessential traffic off without sandbox hooks
• 73f8746 fix(#8750): disable Claude Code nonessential traffic on every route
• 2a769e0 docs: clarify token cost estimate is list price, not contracted rate
• 9578a45 docs(#7230): explain cost estimates from token telemetry
• 1c0e9b1 Merge pull request #8737 from fullsend-ai/agent/8736-cel-retro-triage-prioritize
• 3b7f143 fix(#8736): grant lifecycle close only on the retro route
• 781d83c ci(#8736): route configured retro, triage and prioritize triggers
• 047dc29 feat(#8736): let config triggers route retro, triage and prioritize
• Additional commits viewable in compare view

[github-actions]

Standardized Dependabot Review Summary

Evidence	Value
Dependency review conclusion	success
Risk	medium
Dependency	fullsend-ai/fullsend/.github/workflows/reusable-dispatch.yml
Version	0.50.0
Release age	114 hours
Workflow logs	View run

Eligible for automated approval pending live review-state validation

[github-actions]

Automated dependency approval after static and live review-state validation.
Dependency: fullsend-ai/fullsend/.github/workflows/reusable-dispatch.yml@0.50.0
Dependency review result: success
Dependency review conclusion: success
Risk: medium
Release age: 70 hours (minimum: 24 hours)

[yvonnedevlinrh]

@dependabot rebase

[github-actions]

Automated dependency approval after static and live review-state validation.
Dependency: fullsend-ai/fullsend/.github/workflows/reusable-dispatch.yml@0.50.0
Dependency review result: success
Dependency review conclusion: success
Risk: medium
Release age: 114 hours (minimum: 24 hours)

[github-actions]

Automated dependency approval after static and live review-state validation.
Dependency: fullsend-ai/fullsend/.github/workflows/reusable-dispatch.yml@0.50.0
Dependency review result: success
Dependency review conclusion: success
Risk: medium
Release age: 114 hours (minimum: 24 hours)

[yvonnedevlinrh]

LGTM