reconcile-repos.sh: shim reconciliation destroys custom dispatch jobs

[ascerra]

What happens

The reconcile script compares enrolled repos' .github/workflows/fullsend.yaml against templates/shim-workflow.yaml by content hash and does a full file replacement when they differ. Custom dispatch jobs added by org admins (e.g., dispatch-gh-classify for auto-classifying new issues) are silently removed.

The current workaround is adding custom jobs to the org's templates/shim-workflow.yaml, but this is fragile — the next admin install overwrites all scaffold files including the template.

What should happen

Custom event-driven dispatch jobs should survive both shim reconciliation and admin install. Two directions:

1. Separate workflow files: Custom dispatch jobs live in their own workflow files (e.g., .github/workflows/fullsend-classify.yaml) rather than co-located in the shim. The shim stays template-managed; custom workflows are untouched.
2. Merge-aware reconciliation: The script merges template updates into the existing shim rather than replacing it wholesale, preserving jobs not present in the template.

Option 1 is simpler and aligns with the directory separation work in #632.

Context

During the v0.5.0 upgrade, enrollment PRs (fullsend-ai/experiments#18) removed the dispatch-gh-classify job. The workaround was adding it to the org template (fullsend-ai/.fullsend#11), but this only lasts until the next admin install.

Related

• Directory separation between scaffold-managed and user-added agent files #632 — directory separation for scaffold-managed vs user-added files
• Reduce PR burden moving up to new releases #647 — reduce PR burden moving up to new releases
• reconcile-repos.sh: enrollment check compares file existence, not content #348 — enrollment check compares file existence, not content

[fullsend-ai-triage]

RICE Priority Score: 1.8

Score breakdown

Dimension	Score	Reasoning
Reach	1.5	This affects any org that adds custom dispatch jobs to the shim workflow. The fullsend-ai org already hit this during v0.5.0. As strategic customers like konflux-ci onboard dozens of repos in May 2026 and begin customizing workflows, they will encounter this too. Score reflects multiple strategic customers likely affected.
Impact	1.5	Custom dispatch jobs are silently removed with no warning, breaking org-specific automation (e.g., auto-classification of issues). The workaround of editing the org template is fragile — it only survives until the next admin install. This is a significant pain point but not a complete blocker since core fullsend functionality still works.
Confidence	0.8	High confidence. The issue is well-described with specific code references, reproduction context (v0.5.0 upgrade PRs), two proposed solutions, and clear alignment with related issues (#632, #647). The scope and affected users are well understood.
Effort	1	Medium effort. Option 1 (separate workflow files) is straightforward and aligns with the directory separation work in #632. It requires modifying the reconcile script and enrollment process to manage custom workflows separately from the template-managed shim, touching a few files but with a clear path forward.

Formula: (1.5 × 1.5 × 0.8) / 1 = 1.8

[ralphbean]

/triage