chore: update fullsend shim workflow

[fullsend-ai-fullsend]

This PR updates the fullsend shim workflow to match the current template in the .fullsend config repo.

The shim content has drifted from the template — this brings it back in sync.

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 9:26 PM UTC · Completed 9:36 PM UTC

Commit: 9103755 · View workflow run →

[fullsend-ai-review]

Review

Findings

High

• [permission-expansion] .github/workflows/fullsend.yaml:44 — Reusable workflow reference changed from pinned SHA (701e62a9...) to mutable branch reference (@main). This workflow runs on pull_request_target with elevated permissions including id-token: write (OIDC token minting) and actions: write. SHA pinning ensures immutability of the called workflow code — switching to @main means any push to the main branch of konflux-ci/.fullsend will immediately change the code executed in this privileged context. This is a supply-chain risk and also breaks the repository's established convention of pinning all action/workflow references to immutable SHAs. The branch protection configuration of the external repository cannot be verified from this repo.
  Remediation: Keep the SHA-pinned reference. If the workflow needs to track upstream changes, update the pinned SHA to the new target commit and retain the trailing comment: uses: konflux-ci/.fullsend/.github/workflows/dispatch.yml@<new-sha> # main

• [protected-path] .github/workflows/fullsend.yaml — This PR modifies a file under the protected path .github/. The PR has no linked issue providing justification for modifying governance/infrastructure files. Human approval is required for all protected-path changes.
  Remediation: Link an issue documenting the rationale for this change, or obtain explicit human approval.

Low

• [process-gap] .github/workflows/fullsend.yaml:44 — Security-relevant change (removing SHA pinning for a privileged workflow) submitted by a bot as a template sync with no linked issue or ADR documenting the rationale for accepting increased supply-chain risk.
  Remediation: Document the decision to accept or reject the upstream template's move to @main, either in an issue linked to this PR or in an ADR.

---

Next steps:

• /fs-fix — agent addresses review findings automatically
• /fs-fix <your instruction> — agent fixes with your specific guidance
• Push commits directly — review re-runs automatically on push
• /fs-fix-stop — disable automatic fix runs for this PR

Previous run

Review

Findings

High

• [supply chain / workflow pinning] .github/workflows/fullsend.yaml:44 — The reusable workflow reference is changed from a pinned SHA (701e62a9c6f104ed68f8d4085d9c3b8bad3a82e4) to a mutable branch reference (@main). This workflow grants id-token: write and actions: write permissions at the workflow level, is triggered by pull_request_target, and the workflow comments explicitly document security considerations around credential exfiltration. Every other external action and reusable workflow reference across all workflow files in this repository is pinned to a commit SHA — this change is the sole exception. A compromise of the .fullsend repository’s main branch would immediately grant the attacker the ability to mint OIDC tokens scoped to this repository and trigger arbitrary workflow runs, without any change being reviewed in this repository.
  Remediation: Keep the workflow reference pinned to a specific commit SHA. If the intent is to track upstream updates, use Dependabot or Renovate to propose SHA bumps as reviewable PRs, preserving the # main trailing comment for documentation.

• [protected-path] .github/workflows/fullsend.yaml — This PR modifies a file under the protected path .github/. The PR has no linked issue providing authorization for this change. Human approval is required for all changes to governance and infrastructure files.

Medium

• [supply chain / bot-authored security change] .github/workflows/fullsend.yaml:44 — This security-sensitive change (removing SHA pinning from a privileged workflow) is authored by a bot account (fullsend-ai-fullsend[bot]). The PR description frames this as a template synchronization (“brings it back in sync”), but the practical effect is to weaken a supply chain security control. Bot-authored PRs that degrade security controls warrant heightened scrutiny.
  Remediation: Require explicit human approval for any bot-authored PR that modifies workflow permission scopes or unpins workflow/action references. Consider adding a CODEOWNERS rule for .github/workflows/ that requires security team review.

---

Labels: PR removes SHA pinning from a privileged GitHub Actions workflow reference, weakening supply chain security controls on a protected infrastructure file

---

Next steps:

• /fs-fix — agent addresses review findings automatically
• /fs-fix <your instruction> — agent fixes with your specific guidance
• Push commits directly — review re-runs automatically on push
• /fs-fix-stop — disable automatic fix runs for this PR

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 7:48 PM UTC · Completed 7:59 PM UTC

Commit: 9ee3c25 · View workflow run →

[fullsend-ai-review]

See the review comment for full details.

[fullsend-ai-review]

[high] permission-expansion

Reusable workflow reference changed from pinned SHA (701e62a9c6f104ed68f8d4085d9c3b8bad3a82e4) to mutable branch reference (@main). This workflow runs on pull_request_target with elevated permissions including id-token: write (OIDC token minting) and actions: write. SHA pinning ensures immutability of the called workflow code — switching to @main means any push to the main branch of konflux-ci/.fullsend will immediately change the code executed in this privileged context. This is a supply-chain risk and also breaks the repository's established convention of pinning all action/workflow references to immutable SHAs.

Suggested fix: Keep the SHA-pinned reference. Update the pinned SHA to the new target commit: uses: konflux-ci/.fullsend/.github/workflows/dispatch.yml@ # main

[fullsend-ai-review]

[low] process-gap

Security-relevant change (removing SHA pinning for a privileged workflow) submitted by a bot as a template sync with no linked issue or ADR documenting the rationale for accepting increased supply-chain risk.

Suggested fix: Document the decision to accept or reject the upstream template's move to @main, either in an issue linked to this PR or in an ADR.