feat(run): add --no-post-script flag#666
Conversation
Allow users to run agent inference without post-script side effects (posting PR comments, pushing branches, creating PRs). The agent runs normally inside the sandbox, but the post-script is skipped with a warning message. Named --no-post-script instead of --dry-run because the agent still runs full inference with real GCP costs — dry-run would be misleading. Signed-off-by: Wayne Sun <gsun@redhat.com>
Review: #666Head SHA: ec40bf0 SummaryClean, well-scoped addition of a FindingsNone. FooterOutcome: approve Previous runReview: #666Head SHA: 9f3c18e SummaryClean, well-scoped addition of a FindingsNo findings. FooterOutcome: approve |
![fullsend-ai-review[bot]](https://avatars.githubusercontent.com/u/271249281?s=60&v=4){kind=small}
- Log flag state in initial plan output so users see it immediately - Include post-script name in skip warning for easier debugging - Add defensive comment to composite action YAML warning against exposing --no-post-script as a workflow input in CI Signed-off-by: Wayne Sun <gsun@redhat.com>
ralphbean
left a comment
ralphbean
left a comment
There was a problem hiding this comment.
Clean, well-scoped addition. The naming choice (--no-post-script over --dry-run) is precise, the flag is correctly threaded through the defer closure, and the security comment in action.yml accurately documents the risk. One note below on future hardening — not blocking.
| # SECURITY: Never expose --no-post-script as a workflow input. | ||
| # Post-scripts enforce secret scanning, protected-path blocks, | ||
| # and review-downgrade controls. Skipping them in CI bypasses | ||
| # all post-push security gates. |
There was a problem hiding this comment.
[important — deferred] Good defensive comment. Worth noting: this is documentation of intent, not enforcement. A workflow that calls fullsend run directly (bypassing the composite action) could pass --no-post-script in CI.
A future hardening pass could add a programmatic guard — e.g., detect GITHUB_ACTIONS=true and refuse or warn when --no-post-script is used in CI. CODEOWNERS protection on .github/ provides a secondary control for now.
Not blocking this PR — flagging for future consideration.
2 participants
Summary
--no-post-scriptflag tofullsend runthat skips post-script execution while running agent inference normally--no-post-scriptinstead of--dry-runbecause the agent still runs full inference with real GCP costs —dry-runwould imply no work is doneTest plan
go test -short ./internal/cli/— all tests pass including newTestRunCommand_HasNoPostScriptFlaggo vet ./internal/cli/— clean