Hacktoberfest 2026: the issues maintainers tagged for October, open and beginner-friendly. Browse Hacktoberfest issues

Replace gh CLI in update-fullsend-harness-sha.sh with curl and update stale harness hashes

Closed Beginner friendly
  • Is something wrong?
#276 4 comments 1 reaction 1 assignee View on GitHub

Maintainers usually reply within 1 day

@JohnStrunk is already working on this.

Since Oct 13, 2026.

  • #281 by @fullsend-ai-coder — open

Assessment

Difficulty
2/5
Estimated time
1-3 hours
Newbie friendliness
85/100
Issue type
Bug
Clarity
Clearly specified
Activity status
Active
Tech stack
bash, github
Domain
devops, tooling

Research direction

Start with scripts/renovate/update-fullsend-harness-sha.sh and check how it fetches upstream files and computes their hashes. Replace the GitHub CLI calls with curl, then update .fullsend/harness/fix.yaml, review.yaml, and triage.yaml to the supplied v0.45.0 hashes. Run the script without gh installed and confirm all three hashes match the raw upstream files.

Written by the indexing model from the issue text.

Description

bug infra ready-for-triage ready-to-code

What happened

On 2026-10-13 at 02:01:24 UTC, Renovate opened PR #274 to update fullsend-ai/agents from v0.44.0 to v0.45.0 in .fullsend/harness/*.yaml. Renovate executed the configured postUpgradeTasks script scripts/renovate/update-fullsend-harness-sha.sh to update the #sha256= integrity hashes for each harness base: URL. At line 23, the script called gh api ..., which failed with gh: command not found because the GitHub CLI is not installed in the renovatebot/github-action container image. Renovate posted a warning comment reporting an artifact update error (PR #274 comment). However, because CI had no check validating harness base URL integrity and automerge was enabled, PR #274 merged into main at 02:05:11 UTC. As a result, .fullsend/harness/*.yaml on main currently specifies v0.45.0 base URLs with stale v0.44.0 SHA256 hashes: fix.yaml has 80b42139... (actual 20741c3e...), review.yaml has 92b871a3... (actual 3e9302d8...), and triage.yaml has 98316091... (actual 5ada8f85...).

What could go better

High confidence. Verified against live repository state and upstream content at tag v0.45.0. Any agent execution (e.g., triage, review, fix) that verifies remote harness base integrity against the #sha256= URL fragment is exposed to digest mismatch failures. Furthermore, subsequent Renovate updates for fullsend-ai/agents will repeatedly fail during postUpgradeTasks with gh: command not found. Scripts intended to run inside Renovate's execution container should rely on ubiquitous tools like curl and sha256sum/shasum rather than host-dependent binaries like gh.

Proposed change

  1. In scripts/renovate/update-fullsend-harness-sha.sh, replace gh api calls with curl -fsSL targeting the raw GitHub content URL (https://raw.githubusercontent.com/fullsend-ai/agents/v${version}/${file_path}). Optionally pass Authorization: token ${GH_TOKEN:-${GITHUB_TOKEN:-}} if present in the environment.
  2. Update .fullsend/harness/fix.yaml, .fullsend/harness/review.yaml, and .fullsend/harness/triage.yaml to the verified SHA256 hashes for v0.45.0:
    • fix.yaml: 20741c3ef52e41f4a5e5a78b02a91859b9300172798eea3dd448896b1f369066
    • review.yaml: 3e9302d8143fcfd93df8e4542162776e98893c8ef367450679e2ffa89e5b0c53
    • triage.yaml: 5ada8f85cee204e2fcb8ba6935b301345b3dc56ee3f306d6eafd35f7bc4312a7
  3. Optionally, add a check (e.g. in scripts/lint.py) that validates .fullsend/harness/*.yaml #sha256= hashes match remote content to prevent stale hashes from merging.

Validation criteria

  1. Running bash scripts/renovate/update-fullsend-harness-sha.sh in an environment where gh is unavailable succeeds without error.
  2. The SHA256 hashes in .fullsend/harness/*.yaml match the raw file contents of fullsend-ai/agents at v0.45.0.
  3. The next Renovate PR bumping fullsend-ai/agents updates both the version tag and #sha256= hashes with no artifact update error comments.

Generated by retro agent from https://github.com/redhat-et/ProtoBot/pull/275

Dominant language
Go
Stars
6
Forks
8
Avg merge
1d 5h
Merged PRs (30d)
84

Getting set up

This project ships no dev container, Dockerfile or contributing guide, so setting up is up to you: start from its README, and see our first-contribution guide for the general steps.

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from redhat-et/ProtoBot

All issues in redhat-et/ProtoBot

Similar issues

More Go issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.