[divyanshiGupta]

Summary

Add an autonomous Fullsend CI/E2E triage and repair loop for RHDH Plugins.

What changed

• Add trusted intake for completed CI workflow runs.
• Resolve the matching open PR and verify its current head SHA.
• Identify failed leaf jobs and affected workspaces.
• Upload and analyze Jest and Playwright failure evidence.
• Add a read-only ci-triage agent using the retro role.
• Classify failures as code, test, flaky, infrastructure, or unknown.
• Retry high-confidence flaky failures once.
• Reuse the existing Fullsend fix agent through a CI-specific repair harness.
• Restrict repairs to the affected workspace.
• Require targeted verification before committing.
• Add host-side checks for stale heads, unsafe paths, secrets, oversized diffs, and non-fast-forward pushes.
• Add deduplication markers, concurrency controls, repair limits, and needs-human escalation.
• Keep forks diagnosis-only and support fullsend-no-fix as a kill switch.
• Add observe/repair/off rollout controls.

Safety

The agents never push directly. All mutations are performed only after deterministic host-side validation confirms that:

• The PR is still open and unchanged.
• The repair is limited to one approved workspace.
• The diff is within configured limits.
• Secret scanning passes.
• Required verification succeeds.
• The push can be performed as a fast-forward update.

Rollout

The automation defaults to observe mode. Repairs can be enabled gradually with:
FULLSEND_CI_AUTOMATION=repair
FULLSEND_CI_AUTOFIX_WORKSPACES=boost,scorecard,ai-integrations
Set FULLSEND_CI_AUTOMATION=off to disable the loop immediately.

Testing

• CI context and trust-boundary tests
• Schema fixture validation
• Diff guard tests
• Post-script safety tests
• Workflow YAML and permission checks
• Bash syntax checks
  yarn test:ci-agent passes.

For testing this locally, following script can be used:
https://github.com/divyanshiGupta/rhdh-plugins/blob/ci-agent-demo/scripts/ci/fullsend-ci-cursor-demo.cjs

What it does:

1. Reads the PR and CI information using gh.
2. Selects a failed CI workflow run matching the current PR head. It rejects stale runs.
3. Finds failed leaf jobs and determines the affected workspace.
4. Downloads:
   • Failed CI logs
   • Evidence artifacts named fullsend-ci-evidence-*
5. Creates an isolated temporary checkout such as:
   /tmp/rhdh-ci-cursor-demo-xyz/repo
6. Copies the trusted Fullsend agent instructions, skills, and schemas into:
   .ci-agent-demo/
7. Runs Cursor in read-only mode for triage. The agent returns structured JSON containing:
   • Failure category
   • Confidence
   • Root cause
   • Workspace
   • Recommendation
8. If you pass --repair and triage recommends repair, it runs the existing fix-agent instructions locally. Cursor is told to:
   • Modify only the failed workspace
   • Reproduce the failure
   • Run verification
   • Create one local commit if successful
9. Validates the result using the same schema and diff guard used by the production workflow.
10. Never pushes, comments on GitHub, or modifies your main checkout.

Useful options:

Triage only

yarn ci-agent:cursor-demo --pr <PR_URL>

Triage plus local repair attempt

yarn ci-agent:cursor-demo --pr <PR_URL> --repair

Preserve the temporary checkout for inspection

yarn ci-agent:cursor-demo --pr <PR_URL> --repair --keep

Replay a specific CI run

yarn ci-agent:cursor-demo --pr <PR_URL> --run-id <RUN_ID>
After a repair, you can inspect the local commit with:
git -C <temporary-checkout>/repo show --stat --patch <commit>
This demonstrates the core triage-and-repair behavior locally, but it does not simulate the complete production loop: it does not add GitHub labels, push a branch, rerun GitHub Actions, or post PR comments.

✔️ Checklist

• A changeset describing the change and affected packages. (more info)
• Added or Updated documentation
• Tests for new functionality and regression tests for bug fixes
• Screenshots attached (for UI changes)

[invincibleJai]

/cc @subhashkhileri

[invincibleJai]

/cc @rohitkrai03
/cc @durandom

[github-actions]

This PR has been automatically marked as stale because it has not had recent activity from the author. It will be closed if no further activity occurs. If the PR was closed and you want it re-opened, let us know and we'll re-open the PR so that you can continue the contribution!

[github-actions]

This PR has been automatically marked as stale because it has not had recent activity from the author. It will be closed if no further activity occurs. If the PR was closed and you want it re-opened, let us know and we'll re-open the PR so that you can continue the contribution!

[codecov]

⚠️ JUnit XML file not found

The CLI was unable to find any JUnit XML files to upload.
For more help, visit our troubleshooting guide.

[sonarqubecloud]

Quality Gate passed

Issues
1 New issue
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
1.1% Duplication on New Code

See analysis details on SonarQube Cloud