chore(fullsend): add rhdh-coding skill to code and fix agents by rohitkrai03 · Pull Request #4023 · redhat-developer/rhdh-plugins

rohitkrai03 · 2026-07-28T08:48:55Z

Summary

Adds the rhdh-coding skill from redhat-developer/rhdh-skill to the fullsend code and fix agent harnesses via URL-pinned references with sha256 integrity hashes.
Allows raw.githubusercontent.com/redhat-developer/rhdh-skill/ in allowed_remote_resources.
Both agents gain RHDH-specific plugin development patterns (BUI, NFS, backend conventions, testing, dynamic plugin config) alongside their existing upstream skills (code-implementation, fix-review).

Changes

File	Change
`.fullsend/config.yaml`	Add `rhdh-skill` repo to `allowed_remote_resources`
`.fullsend/rhdh/harness/code.yaml`	Add `rhdh-coding` skill to `skills:` field
`.fullsend/rhdh/harness/fix.yaml`	Add `rhdh-coding` skill to `skills:` field

How it works

The harness merge logic concatenates base + child skills. The upstream base already declares code-implementation (for code) and fix-review (for fix). Adding rhdh-coding in the child harness means sandbox agents get both skills at runtime.

Skill pinned at e841099 with tree hash 5a4bc35...cded.

Test plan

Trigger /fs-code on a test issue and verify the rhdh-coding skill appears in the agent's skill list
Confirm the agent uses RHDH coding patterns (BUI, NFS conventions) when implementing

Made with Cursor

rhdh-qodo-merge · 2026-07-28T08:50:20Z

PR Summary by Qodo

Add RHDH coding skill to Fullsend code/fix harnesses

✨ Enhancement ⚙️ Configuration changes 🕐 10-20 Minutes

AI Description

• Allow fetching skills from the redhat-developer/rhdh-skill raw GitHub domain.
• Add the rhdh-coding skill to both RHDH code and fix agent harnesses.
• Pin the remote skill URL by commit and sha256 for integrity and reproducibility.

Diagram

graph TD
  A[".fullsend/config.yaml"] --> B["allowed_remote_resources"] --> C{{"raw.githubusercontent.com/redhat-developer/rhdh-skill"}}
  D["rhdh/harness/code.yaml"] --> E{{"agents base harness (remote)"}} --> F["rhdh code agent"]
  G["rhdh/harness/fix.yaml"] --> E --> H["rhdh fix agent"]
  D --> I{{"rhdh-coding skill (remote)"}} --> F
  G --> I --> H
  subgraph Legend
    direction LR
    _file["YAML file"] ~~~ _remote{{"Remote resource"}} ~~~ _agent["Agent runtime"]
  end

High-Level Assessment

The following are alternative approaches to this PR:

1. Vendor the skill into the repo

➕ No dependency on GitHub raw availability at runtime
➕ Easier code review/auditing since skill content is in-tree
➕ No need to expand allowed_remote_resources
➖ Requires periodic manual updates to keep in sync with upstream rhdh-skill
➖ Increases repo size and maintenance burden
➖ Loses the benefits of commit-pinned external reuse across repos

2. Pin to a release tag instead of a commit SHA

➕ More human-readable versioning (e.g., v1.2.3)
➕ Simplifies coordinated upgrades across environments
➖ Tags can be moved unless you also enforce sha256 integrity (still recommended)
➖ May reduce granularity for hotfix pinning compared to a commit SHA

3. Use a submodule/subtree for rhdh-skill

➕ Keeps skill source available locally while preserving upstream history
➕ Can update via standard git workflows and code review
➖ Adds git workflow complexity (submodule) or merges (subtree)
➖ Still increases repo footprint compared to remote fetch

Recommendation: The current approach (commit-pinned URL plus sha256 integrity and an explicit allowlist entry) is a strong default for a skill catalog: it’s reproducible, reviewable at the reference level, and minimizes repository bloat. Consider vendoring or subtree only if runtime network access/availability becomes a recurring issue or if security policy requires fully in-repo content.

Files changed (3) +5 / -0

Enhancement (2) +4 / -0

code.yamlAdd pinned rhdh-coding skill to code harness +2/-0

Add pinned rhdh-coding skill to code harness

• Introduces a 'skills:' entry pointing to the 'rhdh-coding' skill pinned to a specific commit with a sha256 hash, so the code agent loads RHDH-specific development guidance in addition to the base harness skills.

.fullsend/rhdh/harness/code.yaml

fix.yamlAdd pinned rhdh-coding skill to fix harness +2/-0

Add pinned rhdh-coding skill to fix harness

• Introduces a 'skills:' entry pointing to the same pinned 'rhdh-coding' skill with sha256 integrity, extending the fix agent’s skillset alongside the base harness skills.

.fullsend/rhdh/harness/fix.yaml

Other (1) +1 / -0

config.yamlAllow rhdh-skill in remote resource allowlist +1/-0

Allow rhdh-skill in remote resource allowlist

• Adds 'https://raw.githubusercontent.com/redhat-developer/rhdh-skill/' to 'allowed_remote_resources' so the harness can fetch the new skill at runtime.

.fullsend/config.yaml

rhdh-qodo-merge · 2026-07-28T09:07:32Z

Code Review by Qodo

🐞 Bugs (1) 📘 Rule violations (0) 🔗 Cross-repo conflicts (0) 📜 Skill insights (0)

Context used

✅ Compliance rules (platform): 11 rules

✅ Cross-repo context

Not relevant to this PR: redhat-developer/rhdh

Not relevant to this PR: redhat-developer/rhdh-chart

Not relevant to this PR: redhat-developer/rhdh-operator

Not relevant to this PR: redhat-developer/rhdh-local

1. Overbroad remote allowlist 🐞 Bug ⛨ Security

Description

.fullsend/config.yaml newly allowlists the entire
raw.githubusercontent.com/redhat-developer/rhdh-skill/ path, which (given the existing allowlist
entries are URL prefixes ending in /) likely grants Fullsend permission to fetch any raw file
under that repo. While the current harness skill URL is commit- and sha256-pinned, the broader
allowlist increases future supply-chain blast radius if additional remote resources under that repo
are referenced later.

Code

.fullsend/config.yaml[25]

+    - https://raw.githubusercontent.com/redhat-developer/rhdh-skill/

Relevance

⭐⭐ Medium
Team often accepts supply-chain hardening, but no direct precedent on narrowing Fullsend
allowed_remote_resources prefixes.
PR-#2763
PR-#2389

ⓘ Recommendations generated based on similar findings in past PRs

Evidence

The PR adds a new remote-resource allowlist entry for the redhat-developer/rhdh-skill repo, and
both harnesses consume a remote skill from that repo. Existing allowlist entries are expressed as
URL prefixes ending in /, implying prefix-based allowance rather than a single-file allowlist.

.fullsend/config.yaml[22-26]
.fullsend/rhdh/harness/code.yaml[1-8]
.fullsend/rhdh/harness/fix.yaml[1-8]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
The repo-wide allowlist entry `https://raw.githubusercontent.com/redhat-developer/rhdh-skill/` is broader than what is currently needed (a single pinned skill), which widens the trusted remote-content boundary.

## Issue Context
The harnesses now pull `rhdh-coding` from `redhat-developer/rhdh-skill` and that URL is pinned by commit and `#sha256=...`, which is good. The allowlist, however, appears to be configured as URL-prefix entries (other entries are also prefixes ending in `/`), so it likely permits fetching any file under that repo.

## Fix Focus Areas
- .fullsend/config.yaml[22-26]

### Suggested fix
If Fullsend supports it, replace the repo-wide prefix with the narrowest prefix that still allows the pinned resource, e.g.:
- `https://raw.githubusercontent.com/redhat-developer/rhdh-skill/e84109919ae6085e3dcfe568c695e6dda54874ce/`

Optionally narrow further to the skills path if supported:
- `https://raw.githubusercontent.com/redhat-developer/rhdh-skill/e84109919ae6085e3dcfe568c695e6dda54874ce/skills/`

Keep requiring commit pinning + `#sha256=...` for any future remote resources from this repo.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

_{To customize comments, go to the Qodo configuration screen, or learn more in the docs.}

christoph-jerolimov · 2026-07-28T10:00:16Z

FYI @its-mitesh-kumar

Add the rhdh-coding skill from rhdh-skill to the fullsend code and fix agent harnesses via URL-pinned references. This gives sandbox agents RHDH-specific plugin development patterns (BUI, NFS, backend conventions, testing, dynamic plugin config) that they cannot reliably infer from training data alone. - Allow rhdh-skill repo in allowed_remote_resources - Pin rhdh-coding skill at commit e841099 with sha256 integrity hash - Both code and fix agents gain the skill alongside their existing upstream skills (code-implementation, fix-review) Signed-off-by: Rohit Rai <rohitkrai03@gmail.com> Co-authored-by: Cursor <cursoragent@cursor.com>

sonarqubecloud · 2026-07-28T12:24:42Z

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

rohitkrai03 · 2026-07-28T12:48:48Z

/fs-review

fullsend-ai-review · 2026-07-28T12:50:04Z

🤖 Finished Review · ✅ Success · Started 12:50 PM UTC · Completed 1:01 PM UTC
Commit: 0fae621 · View workflow run →

fullsend-ai-review · 2026-07-28T13:00:56Z

Looks good to me

Labels: PR modifies .fullsend/ agent harness configuration files

rohitkrai03 requested a review from a team as a code owner July 28, 2026 08:48

rohitkrai03 requested a review from durandom July 28, 2026 08:52

rhdh-qodo-merge Bot added the enhancement New feature or request label Jul 28, 2026

rohitkrai03 force-pushed the fullsend/add-rhdh-coding-skill branch from 59b1b4e to 0fae621 Compare July 28, 2026 12:23

fullsend-ai-review Bot approved these changes Jul 28, 2026

View reviewed changes

fullsend-ai-review Bot added ready-for-merge All reviewers approved — ready to merge fullsend labels Jul 28, 2026

gabemontero mentioned this pull request Jul 28, 2026

docs(#4025): add build commands and import conventions to boost AGENTS.md #4026

Open

4 tasks

johnmcollier approved these changes Jul 28, 2026

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

chore(fullsend): add rhdh-coding skill to code and fix agents - #4023

chore(fullsend): add rhdh-coding skill to code and fix agents#4023
rohitkrai03 wants to merge 1 commit into
redhat-developer:mainfrom
rohitkrai03:fullsend/add-rhdh-coding-skill

rohitkrai03 commented Jul 28, 2026

Uh oh!

rhdh-qodo-merge Bot commented Jul 28, 2026

Uh oh!

rhdh-qodo-merge Bot commented Jul 28, 2026

Uh oh!

christoph-jerolimov commented Jul 28, 2026

Uh oh!

sonarqubecloud Bot commented Jul 28, 2026

Uh oh!

rohitkrai03 commented Jul 28, 2026

Uh oh!

fullsend-ai-review Bot commented Jul 28, 2026 •

edited

Loading

Uh oh!

fullsend-ai-review Bot commented Jul 28, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Uh oh!

Conversation

rohitkrai03 commented Jul 28, 2026

Summary

Changes

How it works

Test plan

Uh oh!

rhdh-qodo-merge Bot commented Jul 28, 2026

PR Summary by Qodo

Uh oh!

rhdh-qodo-merge Bot commented Jul 28, 2026

Code Review by Qodo

Uh oh!

christoph-jerolimov commented Jul 28, 2026

Uh oh!

sonarqubecloud Bot commented Jul 28, 2026

Quality Gate passed

Uh oh!

rohitkrai03 commented Jul 28, 2026

Uh oh!

fullsend-ai-review Bot commented Jul 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

fullsend-ai-review Bot commented Jul 28, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

fullsend-ai-review Bot commented Jul 28, 2026 •

edited

Loading