[johnmcollier]

Summary

This PR ports over the Fullsend jira poller from https://github.com/rhdh-parasol/rhdh-plugins/ . The poller is restricted to the RHDH AI team's RHIDP issues for now, but it should be straightforward to expand it later.

In terms of what the PR actually does:

• Add a five-minute Jira poll for the RHDH AI team's RHIDP issues.
  • The poll checks for issues in RHIDP with the fullsend label and that belong to the RHDH AI team (using field cf[10001]).
  • Comments on those Jira issues with /fs-triage or /fs-code will trigger the corresponding Fullsend harness
• Update Fullsend skill URLs and resource allowlists to the renamed redhat-developer/rhdh-skills repository, preserving the existing commit and checksum pins.
• The poller is based on the recommendation from the Fullsend jira docs: https://fullsend.sh/docs/guides/user/jira-integration#scheduled-workflow

Validation

• YAML parsing, Bash syntax checks, ShellCheck, and the global pre-commit check passed.
• If you'd like to try out the workflow being added here:
  • https://github.com/rhdh-parasol/rhdh-plugins/ has a Jira poller for testing, watching issues on https://redhat-stage.atlassian.net
  • Commenting /fs-triage or /fs-code on any RHDHPLAN or RHIDP issue on Jira stage will be caught by the Jira poller on rhdh-parasol/rhdh-plugins
    • The team: RHDH AI requirement is not in place for rhdh-parasol

Before merge

• Make JIRA_BASE_URL available as an Actions variable
  • Done, I've set JIRA_BASE_URL as a variable, pointing to https://redhat.atlassian.net
• Make JIRA_TOKEN / JIRA_USER_EMAIL available as Actions secrets
  • Also done, I've set both of these as Actions secrets, to the Jira bot account token and email that we've been using for testing Fullsend

[codecov]

⚠️ JUnit XML file not found

The CLI was unable to find any JUnit XML files to upload.
For more help, visit our troubleshooting guide.

[rhdh-qodo-merge]

PR Summary by Qodo

Add scoped Jira polling for Fullsend triage and code

✨ Enhancement ⚙️ Configuration changes 📝 Documentation 🕐 20-40 Minutes

AI Description

• Polls opted-in RHDH AI Jira issues every five minutes.
• Routes only /fs-triage and /fs-code comments to dedicated Fullsend harnesses.
• Documents rollout credentials, cohort gates, and expansion steps.

Diagram

graph TD
  A["5-minute Trigger"] --> B["Poll Job"] --> C[("Jira Cohort")] --> D["Dispatch Matrix"] --> E["Fullsend Harness"] --> F["Triage Agent"]
  E --> G["Code Agent"]

Loading

High-Level Assessment

The following are alternative approaches to this PR:

1. Jira webhooks

• ➕ Avoids five-minute polling latency and recurring scheduled runs.
• ➕ Processes commands closer to real time.
• ➖ Requires externally reachable webhook infrastructure and Jira administration.
• ➖ Adds delivery verification, authentication, retry, and replay complexity unsuitable for a limited pilot.

2. Single combined project query

• ➕ Reduces duplicated poll invocations and output files.
• ➕ Centralizes cohort filtering in one JQL expression.
• ➖ Prevents Fullsend from resolving command-author roles independently per Jira project.
• ➖ Makes project-specific authorization and future cohort changes less explicit.

Recommendation: Keep the separate scheduled project polls for this pilot. They preserve per-project role checks, make the opt-in gates auditable, and avoid webhook infrastructure; webhooks can be reconsidered if the pilot expands or lower latency becomes important.

Files changed (6) +219 / -9

Enhancement (2) +32 / -8

code.mdTeach the code agent to consume Jira work items +14/-8

Teach the code agent to consume Jira work items

• Expands the code agent instructions from GitHub-only issues to GitHub or Jira work items. Requires Jira-sourced runs to read the ticket and comments through the supplied API credentials rather than infer details from GitHub.

.fullsend/rhdh/agents/code.md

triage-jira.yamlAdd a Jira-specific triage harness +18/-0

Add a Jira-specific triage harness

• Extends the pinned upstream triage harness with an explicit '/fs-triage' Jira trigger. Disables automatic progression from triage to coding for the pilot.

.fullsend/rhdh/harness/triage-jira.yaml

Documentation (1) +30 / -1

fullsend.mdDocument the RHDH AI Jira pilot +30/-1

Document the RHDH AI Jira pilot

• Documents the supported Jira projects and commands, eligibility gates, explicit triage-to-code behavior, required Actions credentials, and cohort expansion process.

docs/fullsend.md

Other (3) +157 / -0

config.yamlRegister the Jira-aware triage harness +2/-0

Register the Jira-aware triage harness

• Adds the triage agent and points it to the repository-owned Jira harness while retaining the existing code, fix, and review agents.

.fullsend/config.yaml

code.yamlRoute Jira code commands and constrain target branches +13/-0

Route Jira code commands and constrain target branches

• Adds an explicit CEL trigger for Jira '/fs-code' comments on work items. Restricts Jira-generated pull requests to the 'main' target branch while leaving GitHub routing to the existing stage router.

.fullsend/rhdh/harness/code.yaml

fullsend-poll-jira.ymlAdd the scoped Jira polling and dispatch workflow +142/-0

Add the scoped Jira polling and dispatch workflow

• Introduces a five-minute and manually dispatchable workflow that polls RHIDP and RHDHPLAN separately using team, label, and status gates. It validates Jira credentials, builds a dispatch matrix, and invokes the pinned Fullsend reusable harness with job-scoped permissions.

.github/workflows/fullsend-poll-jira.yml

[rhdh-qodo-merge]

Code Review by Qodo

🐞 Bugs (1) 📘 Rule violations (0) 🔗 Cross-repo conflicts (0) 📜 Skill insights (0)

1. A replaced tool can steal Jira secrets 🐞 Bug ⛨ Security

Description

Install fullsend downloads an executable release asset by mutable tag and runs it without checking
a repository-pinned digest or signature. If that asset is replaced upstream, the installed binary
subsequently runs in Poll Jira with JIRA_TOKEN and JIRA_USER_EMAIL and controls the dispatch
data passed to the privileged harness job.

Code

.github/workflows/fullsend-poll-jira.yml[R40-42]

+          gh release download v0.43.0 --repo fullsend-ai/fullsend \
+            -p 'fullsend_0.43.0_linux_amd64.tar.gz' -O - | tar xz
+          sudo mv fullsend /usr/local/bin/

Relevance

●● Moderate

Supply-chain pinning is accepted for privileged actions, but comparable Fullsend pinning findings
were rejected.

PR-#2763
PR-#3256

ⓘ Recommendations generated based on similar findings in past PRs

Evidence

The workflow downloads the v0.43.0 archive and immediately pipes it into tar before installing the
executable, with no content-integrity verification. That executable is then invoked by the Jira
polling step where the Jira token and user email are present in its environment.

.github/workflows/fullsend-poll-jira.yml[35-43]
.github/workflows/fullsend-poll-jira.yml[45-50]
.github/workflows/fullsend-poll-jira.yml[70-78]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
The workflow downloads and executes the Fullsend release archive without verifying its contents, allowing replacement of the mutable release asset to compromise Jira credentials and dispatch data.

## Fix Focus Areas
- .github/workflows/fullsend-poll-jira.yml[35-43]

## Recommended Fix
Store the expected SHA-256 digest for the pinned Fullsend archive in the repository or workflow, download the archive to a file, verify it with `sha256sum --check`, and only then extract and install the binary. Do not fetch the expected digest from the same mutable release.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

---

Context sources

✅ Compliance rules (platform): 11 rules

✅ Cross-repo context — repo relationships

Review mode: ⚖️ Balanced: Downgraded extended -> standard: change is below the extended eligibility bar (hunks 9/18, lines 228/200; both must reach the floor). Router rationale: This introduces a security- and automation-sensitive Jira polling workflow plus multiple harness, trigger, credential, and dispatch paths with substantial independent logic and several plausible integration defects.

Tip of the day

💡 Did you know, you can turn on the rule miner and Qodo learns your standards from review history

More tips ↗ | Customize Qodo ↗ | Qodo docs ↗

[rhdh-qodo-merge]

Important

The /generate_labels command by Qodo is sunsetting on the 1st of October 2026 and will no longer be available. We recommend switching to the latest Qodo review capabilities. Learn more

[johnmcollier]

Hi @redhat-developer/rhdh-plugins-maintainers would one of you be able to review this when you get the chance?

For some context: The RHDH AI wants to enable the jira integration in Fullsend for rhdh-plugins, but since we're adding a new fullsend github workflow, we need a review from one of the maintainers

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud