What happened
PR #363 received thorough review from both the FullSend review agent (run 34094652650) and CodeRabbit. The review agent requested changes with 1 HIGH, 2 MEDIUM, and 10 LOW findings. CodeRabbit posted 4 inline findings. PR #363 was then closed, and PR #364 — containing functionally identical code (same 3 files, same content, differing only in missing trailing newlines) — was opened by an external fork contributor. The review agent was correctly skipped on #364 (author lacks triage permissions). samanthajayasinghe approved and merged #364 without addressing any of the review findings from #363. No follow-up issue was created to track the unresolved findings.
What could go better
The merged code on master contains confirmed bugs with no tracking issue:
HIGH — config.yaml registration gap: .fullsend/harness/review.yaml is not registered in .fullsend/config.yaml under the agents: key. Confirmed: only triage and code have explicit agent entries. The review role is listed under roles: but has no source, meaning the custom review harness (with the coderabbit-review skill) may not be discovered by fullsend unless it auto-discovers harness files by role name convention. Confidence: high that the registration is missing; moderate uncertainty about whether fullsend requires explicit registration or auto-discovers by convention.
MEDIUM — documentation inaccuracies: SKILL.md Step 3 claims .coderabbit.yaml excludes hack/** and **/zz_generated.*.go, but the actual exclusions are different (build/**, .venv/**, etc.). This would cause incorrect path filtering.
MEDIUM — secrets exposure: CODERABBIT_API_KEY passed via --api-key CLI flag is visible in /proc/PID/cmdline on the CI host (runner-side only, not sandbox).
CodeRabbit findings (data-flow bugs):
gh api --paginate without --slurp emits one JSON array per page; multi-page responses break JSON.parse.- The
--plain fallback passes human-readable text to a JSON-only parser; the catch block silently emits [], discarding all valid findings.
- Issue comments lack current-head commit filtering, including stale CodeRabbit summaries.
Minor: All 3 files are missing POSIX trailing newlines.
Proposed change
Create a tracking issue on openshift/ocm-agent-operator to address the unresolved review findings from PR #363 that were merged via PR #364. The issue should enumerate the specific bugs above and prioritize: (1) verify whether .fullsend/config.yaml registration is required and add the entry if so, (2) fix the pagination bug by adding --slurp to gh api --paginate calls, (3) remove or fix the --plain fallback that silently discards findings, (4) correct the SKILL.md path exclusion documentation, (5) consider using environment variable or config file for CODERABBIT_API_KEY instead of CLI flag, (6) add trailing newlines to all 3 files.
Validation criteria
A follow-up PR addresses at least the HIGH and MEDIUM findings (config.yaml registration, documentation inaccuracies, secrets exposure) and the pagination data-flow bug. The coderabbit-review skill produces correct findings on a test PR with multi-page CodeRabbit comments.
Generated by retro agent from #364
What happened
PR #363 received thorough review from both the FullSend review agent (run 34094652650) and CodeRabbit. The review agent requested changes with 1 HIGH, 2 MEDIUM, and 10 LOW findings. CodeRabbit posted 4 inline findings. PR #363 was then closed, and PR #364 — containing functionally identical code (same 3 files, same content, differing only in missing trailing newlines) — was opened by an external fork contributor. The review agent was correctly skipped on #364 (author lacks triage permissions). samanthajayasinghe approved and merged #364 without addressing any of the review findings from #363. No follow-up issue was created to track the unresolved findings.
What could go better
The merged code on master contains confirmed bugs with no tracking issue:
HIGH — config.yaml registration gap:
.fullsend/harness/review.yamlis not registered in.fullsend/config.yamlunder theagents:key. Confirmed: onlytriageandcodehave explicit agent entries. Thereviewrole is listed underroles:but has no source, meaning the custom review harness (with the coderabbit-review skill) may not be discovered by fullsend unless it auto-discovers harness files by role name convention. Confidence: high that the registration is missing; moderate uncertainty about whether fullsend requires explicit registration or auto-discovers by convention.MEDIUM — documentation inaccuracies: SKILL.md Step 3 claims
.coderabbit.yamlexcludeshack/**and**/zz_generated.*.go, but the actual exclusions are different (build/**,.venv/**, etc.). This would cause incorrect path filtering.MEDIUM — secrets exposure:
CODERABBIT_API_KEYpassed via--api-keyCLI flag is visible in/proc/PID/cmdlineon the CI host (runner-side only, not sandbox).CodeRabbit findings (data-flow bugs):
gh api --paginatewithout--slurpemits one JSON array per page; multi-page responses breakJSON.parse.--plainfallback passes human-readable text to a JSON-only parser; the catch block silently emits[], discarding all valid findings.Minor: All 3 files are missing POSIX trailing newlines.
Proposed change
Create a tracking issue on
openshift/ocm-agent-operatorto address the unresolved review findings from PR #363 that were merged via PR #364. The issue should enumerate the specific bugs above and prioritize: (1) verify whether.fullsend/config.yamlregistration is required and add the entry if so, (2) fix the pagination bug by adding--slurptogh api --paginatecalls, (3) remove or fix the--plainfallback that silently discards findings, (4) correct the SKILL.md path exclusion documentation, (5) consider using environment variable or config file forCODERABBIT_API_KEYinstead of CLI flag, (6) add trailing newlines to all 3 files.Validation criteria
A follow-up PR addresses at least the HIGH and MEDIUM findings (config.yaml registration, documentation inaccuracies, secrets exposure) and the pagination data-flow bug. The coderabbit-review skill produces correct findings on a test PR with multi-page CodeRabbit comments.
Generated by retro agent from #364