Retro stage should check out post-merge ref on pull_request_target closed events

[guyoron1]

What happened

PR #26 in konflux-ci/refinement added a judge-score gate to AGENTS.md and docs/agents/retro-filing.md (merged 15:52 UTC). When the retro dispatched on PR #26's merge (run 30467986234, ~16:10 UTC), the checkout resolved to 3fa40d5 — the base branch HEAD before the merge commit bf2445e landed. The retro agent ran against the pre-merge repo state: AGENTS.md still had the old pirate-voice instructions (from PR #23), docs/agents/retro-filing.md did not exist in the working tree, and the judge-score gate was invisible. The retro filed agents#528 without applying the scoring rubric. This prompted a follow-up PR #27 to add the gate as a harness skill override — but even that approach is subject to the same checkout-ref issue for the retro analyzing PR #27 itself (.fullsend/skills/retro-filing-policy/ and .fullsend/harness/retro.yaml are also read from the checked-out tree).

What could go better

Judge score: 3/5 — Actionable process gap. The retro dispatch resolves its checkout ref from github.sha, which for pull_request_target events GitHub defines as the base branch HEAD at event creation time — not the merge commit. This is the same class of bug as #5378 (which fixes action.yml reconcile-status) but affects a different code path: the checkout step in the retro stage of reusable-dispatch.yml. For the retro stage specifically, checking out the pre-merge ref means the agent cannot see AGENTS.md changes, .fullsend/ config modifications, or skill additions introduced by the merged PR. The retro needs the latest governance config to guide its own filing behavior, even though it analyzes a workflow that ran under the old config. Evidence: workflow logs show HEAD is now at 3fa40d5 in all jobs of run 30467986234, 18 minutes after the merge commit bf2445e landed. Confidence is moderate — the stale checkout is clearly evidenced in logs, but there is some possibility this is intentional design (retro should see the as-was state). The functional impact argues against that interpretation: the retro's own behavioral guidance (AGENTS.md instructions, filing skills) should reflect the current repo state.

Proposed change

In the retro dispatch path of reusable-dispatch.yml, when the trigger event is pull_request_target with action closed and github.event.pull_request.merged == true, use github.event.pull_request.merge_commit_sha as the checkout ref instead of github.sha. This ensures the retro agent sees the post-merge repo state including AGENTS.md, .fullsend/ config, and skill files. Other agent stages (review, code, fix) should continue using the PR head SHA (github.event.pull_request.head.sha) as they operate on pre-merge state. Related to #5378 (same github.sha root cause, different fix location and different impacted code path).

Validation criteria

The next 3 retro runs triggered by PR merges in repos with per-repo install mode should check out a ref that includes the merged PR's changes. Verify by checking the HEAD is now at log line in the retro job — the commit should be the merge commit or a descendant, not a pre-merge ancestor. Additionally, a retro on a PR that modifies AGENTS.md should show evidence of reading the updated AGENTS.md (not the pre-merge version) in its reasoning trace.

---

Generated by retro agent from https://github.com/konflux-ci/refinement/pull/27

[fullsend-ai-triage]

🤖 Finished Triage · ✅ Success · Started 8:44 AM UTC · Completed 8:48 AM UTC
Commit: c887fc4 · View workflow run →

[guyoron1]

/fs-triage

[fullsend-ai-triage]

Triage Summary

Severity: High — the retro agent operates on stale pre-merge state for every merged PR, missing governance config changes.

Root Cause: The retro dispatch path in reusable-dispatch.yml uses github.sha as the checkout ref. For pull_request_target events, GitHub defines this as the base branch HEAD at event creation time — not the merge commit. Log evidence confirms the checkout resolved to commit 3fa40d5 (pre-merge) instead of bf2445e (merge commit).

Recommended Fix: In the retro stage's checkout step, use github.event.pull_request.merge_commit_sha when the trigger is a merged PR (pull_request_target / closed / merged == true). Other agent stages should continue using the PR head SHA. This is the same class of bug as fullsend-ai#5378 (which addresses action.yml reconcile-status) but in a different code path — the two fixes are independent.

Proposed Test Case:

1. Merge a PR that modifies AGENTS.md in a per-repo install repo
2. Check the retro job logs for 'HEAD is now at <sha>'
3. Assert <sha> matches the merge commit, not the pre-merge base branch HEAD
4. Verify the retro's reasoning trace references updated AGENTS.md content
5. Confirm non-retro stages still use the PR head SHA

⚠ Workflow file change required: This fix modifies .github/workflows/reusable-dispatch.yml. The code agent cannot modify workflow files under current permissions — manual intervention (human PR or maintainer action) is required.

---

Next steps:

• /fs-code — agent creates a PR to implement this issue
• /fs-code <your instruction> — agent implements with your specific guidance

---

Next steps:

• /fs-code — agent creates a PR to implement this issue
• /fs-code <your instruction> — agent implements with your specific guidance

Previous run

Triage Summary

Severity: High — the retro agent operates on stale pre-merge state for every merged PR, missing governance config changes.

Root Cause: The retro dispatch path in reusable-dispatch.yml uses github.sha as the checkout ref. For pull_request_target events, GitHub defines this as the base branch HEAD at event creation time — not the merge commit. Log evidence confirms the checkout resolved to commit 3fa40d5 (pre-merge) instead of bf2445e (merge commit).

Recommended Fix: In the retro stage's checkout step, use github.event.pull_request.merge_commit_sha when the trigger is a merged PR (pull_request_target / closed / merged == true). Other agent stages should remain unchanged.

This is the same class of bug as fullsend-ai#5378 (which addresses action.yml reconcile-status) but in a different code path.

Proposed Test Case:

1. Merge a PR that modifies AGENTS.md in a per-repo install repo
2. Check the retro job logs for 'HEAD is now at <sha>'
3. Assert <sha> matches the merge commit, not the pre-merge base branch HEAD
4. Verify the retro's reasoning trace references updated AGENTS.md content
5. Confirm non-retro stages (review, code, fix) still use the PR head SHA

⚠ Workflow file change required: This fix modifies .github/workflows/reusable-dispatch.yml. The code agent cannot modify workflow files under current permissions — manual intervention (human PR or maintainer action) is required.

---

Labels: This is a bug in the dispatch workflow component with high priority — it affects every retro run on merged PRs.

---

Next steps:

• /fs-code — agent creates a PR to implement this issue
• /fs-code <your instruction> — agent implements with your specific guidance

[fullsend-ai-triage]

🤖 Finished Triage · ✅ Success · Started 8:53 AM UTC · Completed 8:57 AM UTC
Commit: c887fc4 · View workflow run →

[guyoron1]

/fs-code

[fullsend-ai-coder]

🤖 Finished Code · ❌ Failure · Started 9:28 AM UTC · Completed 9:37 AM UTC
Commit: c887fc4 · View workflow run →

[fullsend-ai-coder]

⚠️ Post-code script failed — Pre-commit blocked (exit code 1)

The code agent completed, but the post-code script failed before finishing.

Workflow run: https://github.com/guyoron1/fullsend/actions/runs/30741778525

Details:
check toml...........................................(no files to check)Skipped
mixed line ending........................................................Passed
ruff (legacy alias)..................................(no files to check)Skipped
ruff format..........................................(no files to check)Skipped
ty check.............................................(no files to check)Skipped
bandit...............................................(no files to check)Skipped
Detect hardcoded secrets.................................................Passed
shellcheck...........................................(no files to check)Skipped
pinact (SHA-pin check)...................................................Failed
- hook id: pinact
- exit code: 2

�[31mERROR�[0m failed to handle a line: action can't be pinned
.github/workflows/fullsend.yaml:52
    uses: guyoron1/fullsend/.github/workflows/reusable-dispatch.yml@main
::error file=.github/workflows/fullsend.yaml,line=52,title=pinact error::action can't be pinned

Lint GitHub Actions workflow files.......................................Passed
gofmt....................................................................Passed
go vet...................................................................Passed
lint mint embed sync.................................(no files to check)Skipped
lint interface doc sync..............................(no files to check)Skipped
lint ADR statuses....................................(no files to check)Skipped
lint ADR numbers.....................................(no files to check)Skipped
lint ADR frontmatter.................................(no files to check)Skipped
lint broken symlinks.....................................................Passed
lint docs link scope.................................(no files to check)Skipped
lint markdown links......................................................Passed
lint workflow file size..............................(no files to check)Skipped
lint-staged (web)....................................(no files to check)Skipped

Please check the workflow logs for full details and retry with /fs-code if appropriate.