Update conforma/.fullsend digest to cd01138 (main)

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
conforma/.fullsend	workflow	digest	4ad3612 → cd01138

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • Between 12:00 AM and 03:59 AM (* 0-3 * * *)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 2:09 AM UTC · Completed 2:15 AM UTC

Commit: cd01138 · View workflow run →

Runtime: claude · Model: opus → claude-opus-4-7 · Effort: high · Cost: $2.55

[fullsend-ai-review]

Risk Assessment: moderate (2/5)

Details

Renovate bot digest-pin bump of a single line in a CI workflow shim. Change is tiny (1 file, 2 lines, small blast radius), no security-sensitive or dependency files touched, low historical churn (2 commits in the last 90d), no fix/revert history, author is a trusted bot. Slight elevation above baseline (composite 1.58 → 2) comes from touching a protected path (.github/) and a CI workflow file, but the change is a mechanical digest update with no semantic impact.

[fullsend-ai-review]

Review

Findings

Medium

• [protected-path] .github/workflows/fullsend.yaml — Renovate bot digest bump modifies a governance/infrastructure path (.github/). The uses: ref for conforma/.fullsend/.github/workflows/dispatch.yml moves from 4ad3612 → cd01138, verified as a real commit on conforma/.fullsend@main (merge of a subsequent Renovate PR authored by robnester-rh on 2026-09-05). The repo's renovate.json extends the org-wide Renovate configuration, which authorizes automated dependency updates including workflow ref pins, and the shim runs pull_request_target from the base branch (unchanged by this PR, so credential-exfiltration surface is unaffected). Human approval is always required for protected-path changes, regardless of context.
  Remediation: A human maintainer must review and merge — do not rely on automated approval.

[fullsend-ai-review]

See the review comment for full details.

[fullsend-ai-review]

[medium] protected-path

PR modifies a governance/infrastructure path (.github/). The change is a mechanical Renovate digest bump of the conforma/.fullsend/.github/workflows/dispatch.yml reusable-workflow ref from 4ad3612 to cd01138. Verified: the new SHA is a real commit on conforma/.fullsend@main authored by a Renovate 'Pin dependencies' PR merged by a repo maintainer. The repo's renovate.json (which extends the org-wide conforma/.github//config/renovate/renovate.json) explicitly authorizes automated dependency updates, providing tool-level authorization for this class of change. Human approval is still required for protected-path changes.

Suggested fix: A human maintainer must review and merge — do not rely on automated approval.

[robnester-rh]

Expediting: unbreaks fullsend under sha_pinning_required by advancing the .fullsend pin to the fully-pinned main (cd011389). Ref: EC-2173/EC-2185.

[fullsend-ai-retro]

🤖 Finished Retro · ✅ Success · Started 7:36 PM UTC · Completed 7:41 PM UTC

Commit: cd01138 · View workflow run →

Runtime: claude · Model: opus → claude-opus-4-7 · Effort: high · Cost: $1.71

[fullsend-ai-retro]

Retro on conforma/user-guide#250 — a Renovate digest-pin bump of conforma/.fullsend in .github/workflows/fullsend.yaml. Not agent-authored, so only Review + Retro ran. The review agent correctly flagged a Medium [protected-path] finding, but the PR sat 3.5 days waiting for a human before robnester-rh expedited-approved with a note that the old pin was actively broken under sha_pinning_required.

Two new proposals below. Also surfaced but not filed as duplicates:

• Merge event fanned out to 3 concurrent Retro dispatches (runs 34395921135, 34395928056, 34396124420 on the same head SHA within ~2 minutes, no /fs-retro comment). Adjacent open issues cover parts of this: fullsend-ai/fullsend#2190 (retro concurrency on PR open), fullsend-ai/fullsend#6153 (bulk-close debounce), and the meta-consolidation fullsend-ai/fullsend#5817. New data point: the same trigger (single merge) can fire three dispatches — worth folding into #5817.
• Wasted review on bot-authored dependency PRs is already tracked by fullsend-ai/agents#257 (pre-review early-exit for bot dep-update PRs). This PR is another data point: identical [protected-path] finding also fired on the Renovate PRs Update github actions (main) (patch) #234 and Update github actions (main) (minor) #235 in this repo (7 and 19 review runs respectively before merge).

Proposals skipped (target repo not allowed)

File manually or update create_issues.allow_targets in config.yaml:

• Risk-assessment comment emits duplicate <!-- fullsend:risk-assessment --> sentinel (fullsend-ai/agents)
• Narrow auto-approve rule for Renovate SHA-pin bumps of the .fullsend runner ref (fullsend-ai/agents)