Skip to content

feat: add per-repo installation mode (ADR 0033) #799

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
waynesun09 merged 7 commits into from
May 14, 2026
Merged

feat: add per-repo installation mode (ADR 0033) #799

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
7 commits
Select commit Hold shift + click to select a range
3bcd099
feat: add per-repo installation mode with centralized dispatch
waynesun09 May 12, 2026
b4c2ac9
feat: auto-provision WIF infrastructure in per-repo install
waynesun09 May 12, 2026
5997e48
feat: auto-detect shared public apps and copy PEM secrets across orgs
waynesun09 May 12, 2026
5c02d4f
fix: authenticate GitHub API call in fullsend action to avoid rate limit
waynesun09 May 12, 2026
5e36b45
fix: align per-repo install with direct WIF and repo-scoped bindings
waynesun09 May 13, 2026
255699f
fix: resolve lint failures for detect-private-key and shellcheck SC2295
waynesun09 May 13, 2026
07a7d2a
fix: scaffold customized/ dirs in per-org install
waynesun09 May 13, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
35 changes: 24 additions & 11 deletions .github/actions/validate-enrollment/action.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,6 +5,10 @@ inputs:
source_repo:
description: 'Source repository in owner/repo format'
required: true
install_mode:
description: 'Installation mode: per-org (config repo) or per-repo (in-repo config)'
required: false
default: 'per-org'

outputs:
name:
Expand All @@ -18,6 +22,7 @@ runs:
shell: bash
env:
SOURCE_REPO: ${{ inputs.source_repo }}
INSTALL_MODE: ${{ inputs.install_mode }}
run: |
set -euo pipefail
: "${SOURCE_REPO:?SOURCE_REPO is required}"
Expand All @@ -31,19 +36,27 @@ runs:
echo "::error::source_repo owner does not match org"
exit 1
fi
REPO_NAME="${SOURCE_REPO#*/}"
if [[ ! -f config.yaml ]]; then
echo "::error::config.yaml not found"
exit 1
fi
if ! command -v yq &> /dev/null; then
echo "::error::yq command not found"
if [[ "${INSTALL_MODE}" != "per-org" && "${INSTALL_MODE}" != "per-repo" ]]; then
echo "::error::Invalid install_mode '${INSTALL_MODE}': must be 'per-org' or 'per-repo'"
exit 1
fi
ENABLED=$(yq ".repos.\"$REPO_NAME\".enabled" config.yaml)
if [[ "$ENABLED" != "true" ]]; then
echo "::error::repo is not enabled in config.yaml"
exit 1
REPO_NAME="${SOURCE_REPO#*/}"
if [[ "${INSTALL_MODE}" == "per-repo" ]]; then
echo "Per-repo mode — skipping config.yaml enrollment check (self-enrolled)"
else
if [[ ! -f config.yaml ]]; then
echo "::error::config.yaml not found"
exit 1
fi
if ! command -v yq &> /dev/null; then
echo "::error::yq command not found"
exit 1
fi
ENABLED=$(REPO_NAME="${REPO_NAME}" yq 'env(REPO_NAME) as $name | .repos[$name].enabled' config.yaml)
if [[ "$ENABLED" != "true" ]]; then
echo "::error::repo is not enabled in config.yaml"
exit 1
fi
fi
echo "Validation passed for ${SOURCE_REPO}"

Expand Down
23 changes: 19 additions & 4 deletions .github/workflows/reusable-code.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -24,6 +24,10 @@ on:
required: false
type: string
default: 'latest'
install_mode:
required: false
type: string
default: 'per-org'
secrets:
FULLSEND_GCP_WIF_PROVIDER:
required: true
Expand Down Expand Up @@ -55,9 +59,15 @@ jobs:
sparse-checkout: |
internal/scaffold/fullsend-repo/

- name: Prepare workspace (upstream defaults + org overrides)
- name: Prepare workspace (upstream defaults + org/repo overrides)
env:
INSTALL_MODE: ${{ inputs.install_mode }}
Copy link
Copy Markdown
Contributor

@ralphbean ralphbean May 13, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[moderate] (deferred) The install_mode validation + CUSTOM_BASE path switching block (~20 lines) is duplicated identically across all 5 reusable workflow files. Consider extracting into a composite action (e.g., .github/actions/prepare-workspace/) to reduce maintenance burden and divergence risk.

run: |
set -euo pipefail
if [[ "${INSTALL_MODE}" != "per-org" && "${INSTALL_MODE}" != "per-repo" ]]; then
echo "::error::Invalid install_mode '${INSTALL_MODE}': must be 'per-org' or 'per-repo'"
exit 1
fi
SRC=".defaults/internal/scaffold/fullsend-repo"
LAYERED_DIRS="agents skills schemas harness policies scripts env"
for dir in ${LAYERED_DIRS}; do
Expand All @@ -66,11 +76,15 @@ jobs:
cp -r "${SRC}/${dir}/." "${dir}/"
fi
done
CUSTOM_BASE="customized"
if [[ "${INSTALL_MODE}" == "per-repo" ]]; then
CUSTOM_BASE=".fullsend/customized"
fi
for dir in ${LAYERED_DIRS}; do
if [[ -d "customized/${dir}" ]]; then
find "customized/${dir}" -type f ! -name '.gitkeep' -print0 \
if [[ -d "${CUSTOM_BASE}/${dir}" ]]; then
find "${CUSTOM_BASE}/${dir}" -type f ! -name '.gitkeep' -print0 \
| while IFS= read -r -d '' f; do
rel="${f#customized/}"
rel="${f#"${CUSTOM_BASE}"/}"
mkdir -p "$(dirname "${rel}")"
cp "${f}" "${rel}"
done
Expand All @@ -85,6 +99,7 @@ jobs:
uses: fullsend-ai/fullsend/.github/actions/validate-enrollment@v0
with:
source_repo: ${{ inputs.source_repo }}
install_mode: ${{ inputs.install_mode }}

- name: Mint coder token
id: app-token
Expand Down
Loading
Loading