feat: make retro agent multi-forge (GitHub + GitLab)

[ggallen]

Context

The retro agent (Phase 5 in the multi-forge work breakdown) needs GitLab support. The triage agent (Phase 1) is already multi-forge on main. The code agent (PR #813) and review agent (PR #815) are in-progress. The retro agent is independent of both — no shared library deps, standalone scripts — so it can proceed in parallel.

The upstream runtime (fullsend-ai/fullsend) already supports ResolveForge(platform) which merges forge.<platform> sections into top-level harness fields. No runtime changes are needed.

Goal: The retro agent harness runs on both GitHub and GitLab, dispatching forge-specific operations via FULLSEND_FORGE env var.

Patterns to Follow

Established by triage (merged), code (#813), and review (#815):

1. Three-file lib pattern: {agent}-ops.lib.sh (dispatcher) + github-{agent}-ops.lib.sh + gitlab-{agent}-ops.lib.sh. All forge functions prefixed forge_*. Dispatcher uses include guard + case on FULLSEND_FORGE.
2. Same pre/post scripts for both forges. Scripts source the dispatcher lib and call forge_* functions. No if github/if gitlab in the main script — the dispatch is inside the ops lib.
3. .src.sh source files bundled via make script-build. The .sh files are generated — # GENERATED from <name>.src.sh -- DO NOT EDIT.
4. Harness: forge.github and forge.gitlab sections with per-forge policy, skills, host_files, env (runner + sandbox). Top-level retains forge-neutral fields only.
5. Env normalization: Harness env sections map forge-specific input vars to uniform names (ORIGINATING_URL, FULLSEND_FORGE).
6. Policy split: policies/github/{agent}.yaml and policies/gitlab/{agent}.yaml. GitHub allows gh not curl; GitLab allows curl not gh. Both allow node.
7. Skills split: Agent-specific skills with forge-specific CLI recipes in subdirs (skills/{skill}/github/SKILL.md, skills/{skill}/gitlab/SKILL.md). Shared methodology stays at top level.
8. GitLab _gitlab_api() helper: Each agent's GitLab ops lib defines a private _gitlab_api() curl wrapper with timeouts, PRIVATE-TOKEN header, error handling.
9. GitLab host validation: Allowed hosts are gitlab.com and gitlab.cee.redhat.com.
10. _gha_sanitize(): Defined in the dispatcher lib (triage and review do this; code does not). Retro should include it since post-retro.sh uses GHA workflow commands.

Files to Create

1. scripts/lib/retro-ops.lib.sh — Forge dispatcher (~25 lines)

Include guard (RETRO_OPS_SH_LOADED), _gha_sanitize(), case switch on FULLSEND_FORGE sourcing the correct forge ops lib. Copy the pattern from scripts/lib/triage-ops.lib.sh.

2. scripts/lib/github-retro-ops.lib.sh — GitHub forge ops

Extract from current post-retro.sh. Functions needed:

• forge_validate_originating_url — regex validates https://github.com/.../issues|pull/N
• forge_parse_originating_url — sets ORIGINATING_REPO, ORIGINATING_NUMBER
• forge_create_label "$repo" "$name" "$description" "$color" — gh label create
• forge_create_issue "$repo" "$title" "$body" "$label" — gh issue create --label, returns URL
• forge_post_comment "$repo" "$number" "$body" — gh api repos/.../issues/.../comments
• forge_mask_token — echo "::add-mask::${GH_TOKEN}"
• forge_get_config_workspace — returns ${GITHUB_WORKSPACE:-/tmp}
• forge_get_comment_max_len — returns 65000 (GitHub limit)

3. scripts/lib/gitlab-retro-ops.lib.sh — GitLab forge ops

Same interface, using curl + GitLab REST API:

• _gitlab_api() — private curl wrapper with PRIVATE-TOKEN: ${GITLAB_TOKEN}, timeouts
• forge_validate_originating_url — validates GitLab issue/MR URL pattern + allowed hosts
• forge_parse_originating_url — extracts GITLAB_HOST, ORIGINATING_REPO, REPO_ENCODED, ORIGINATING_NUMBER from GitLab URL (handles /-/issues/N and /-/merge_requests/N)
• forge_create_label — POST /projects/:id/labels (idempotent via || true)
• forge_create_issue — POST /projects/:id/issues with labels=, returns web_url
• forge_post_comment — detects issue vs MR from URL, posts to /issues/:iid/notes or /merge_requests/:iid/notes
• forge_mask_token — no-op or GitLab CI equivalent (echo "::add-mask::" is GHA-only, harmless on other runners)
• forge_get_config_workspace — returns ${CI_PROJECT_DIR:-/tmp}
• forge_get_comment_max_len — returns 1000000 (GitLab limit is ~1MB)

4. scripts/pre-retro.src.sh — Source file for pre-retro (~35 lines)

Convert current pre-retro.sh to .src.sh. Add:

• FULLSEND_FORGE required env var
• Source retro-ops.lib.sh
• Replace hardcoded github.com regex with forge_validate_originating_url
• Use _gha_sanitize() for the ::notice:: output

5. scripts/post-retro.src.sh — Source file for post-retro

Convert current post-retro.sh to .src.sh. Replace all GitHub-specific calls:

• Token handling: forge_mask_token instead of echo "::add-mask::${GH_TOKEN}"
• URL parsing: forge_validate_originating_url + forge_parse_originating_url instead of inline regex
• Config workspace: forge_get_config_workspace instead of ${GITHUB_WORKSPACE:-/tmp}
• Label creation: forge_create_label instead of gh label create
• Issue creation: forge_create_issue instead of gh issue create
• Comment posting: forge_post_comment instead of gh api .../comments
• Comment truncation: forge_get_comment_max_len instead of hardcoded 65000
• GHA workflow commands (::warning::): wrap in _gha_sanitize or emit conditionally
• Remove GH_TOKEN required check — replaced with forge-aware token check in ops lib
• Keep all business logic unchanged: evidence-for filtering, allowlist gates, proposal validation, comment assembly

6. policies/gitlab/retro.yaml

Based on policies/retro.yaml (which becomes policies/github/retro.yaml). Changes:

• Replace github_api with gitlab_api: allow gitlab.com, gitlab.cee.redhat.com on port 443
• Binary allowlist: curl, node (no gh)
• Replace github_artifacts with gitlab_artifacts: allow GitLab CI artifact hosts (or remove if not needed — GitLab CI artifacts may use different endpoints)
• Keep Vertex AI section unchanged

7. env/github/retro.env (~5 lines)

Move content from env/retro.env, add FULLSEND_FORGE=github.

8. env/gitlab/retro.env (~5 lines)

export ORIGINATING_URL="${ORIGINATING_URL}"
export RETRO_COMMENT="${RETRO_COMMENT:-}"
export REPO_FULL_NAME="${REPO_FULL_NAME}"
export GITLAB_TOKEN="${GITLAB_TOKEN}"
export FULLSEND_FORGE=gitlab

9. Skills — retro-analysis split

skills/retro-analysis/SKILL.md — Keep shared methodology only:

• Exploration strategy (subagent dispatch patterns)
• Test flakiness detection and what to propose
• Duplicate checking guidance (make forge-neutral: "use your forge skill's search commands")
• Localization guidance
• Output format
• Writing good proposals
• Remove all gh run list, gh run view, gh run download, gh api "search/issues" recipes

skills/retro-analysis/github/SKILL.md — GitHub CLI recipes:

• Workflow tracing: gh run list, gh run view, gh run download
• Duplicate search: gh api "search/issues?q=..."
• Agents repo discovery from run logs

skills/retro-analysis/gitlab/SKILL.md — GitLab CLI recipes:

• Pipeline tracing: curl to /projects/:id/pipelines, /projects/:id/pipelines/:id/jobs
• Job logs: curl to /projects/:id/jobs/:id/trace
• Artifact download: curl to /projects/:id/jobs/:id/artifacts
• Duplicate search: curl to /projects/:id/issues?search=...
• Environment setup: derive GITLAB_HOST, REPO_ENCODED from REPO_FULL_NAME

10. Skills — finding-agent-runs split

skills/finding-agent-runs/SKILL.md — Keep shared methodology only:

• Dispatch repo pattern (${ORG}/.fullsend)
• Issue → agent runs flow (conceptual)
• PR → agent runs flow (conceptual)
• Common failure signatures table
• Remove all gh run list, gh run view, gh run download recipes

skills/finding-agent-runs/github/SKILL.md — GitHub CLI recipes:

• All current gh run list --workflow=... commands
• gh run view <RUN_ID> for job outcomes and logs
• gh run download <RUN_ID> for artifacts

skills/finding-agent-runs/gitlab/SKILL.md — GitLab CLI recipes:

• Pipeline listing: curl to /projects/:id/pipelines?ref=main
• Job listing: curl to /projects/:id/pipelines/:id/jobs
• Job logs: curl to /projects/:id/jobs/:id/trace
• Artifact download: curl to /projects/:id/jobs/:id/artifacts

Files to Move/Rename

• policies/retro.yaml → policies/github/retro.yaml (add comment about curl exclusion)
• env/retro.env → env/github/retro.env (add FULLSEND_FORGE=github)

Files to Modify

harness/retro.yaml

• Remove top-level policy: (moves into forge sections)
• Remove top-level pre_script: / post_script: (moves into forge sections)
• Update skills: to retain only forge-neutral skills at top level: agent-scaffolding, autonomy-readiness
• Add forge-specific skills to each forge section
• Expand forge.github with: policy, skills (add github-forge, retro-analysis/github, finding-agent-runs/github), host_files (with env/github/retro.env), env.sandbox
• Add forge.gitlab with: policy, pre_script, post_script, skills (add gitlab-forge, retro-analysis/gitlab, finding-agent-runs/gitlab), host_files (with env/gitlab/retro.env), env (runner + sandbox with GITLAB_TOKEN, FULLSEND_FORGE: gitlab)
• Add FULLSEND_FORGE to both forge env blocks

agents/retro.md

• Line 6: "GitHub issues" → "issues" in description
• Line 128: "GitHub mutations" → "forge mutations"
• Add curl to tools list: tools: Bash(gh,curl,jq,yq)
• Add FULLSEND_FORGE as an input

schemas/retro-result.schema.json

• Line 19: "Each becomes a GitHub issue." → "Each becomes an issue on the source forge."
• target_repo pattern: relax from ^[a-zA-Z0-9._-]+/[a-zA-Z0-9._-]+$ (two segments) to ^[a-zA-Z0-9._-]+(/[a-zA-Z0-9._-]+)+$ (one or more /-separated segments, supports GitLab subgroups)

docs/retro.md

• "GitHub issues" → "issues" (lines 4, 71)

Makefile

• Add scripts/pre-retro.src.sh and scripts/post-retro.src.sh to BUNDLE_SRCS

scripts/post-retro-test.sh

• Update existing GitHub tests to set FULLSEND_FORGE=github and use ORIGINATING_URL
• Add GitLab test section (~200 lines): mock curl, set FULLSEND_FORGE=gitlab, GITLAB_TOKEN, GitLab ORIGINATING_URL, verify no gh calls, test issue creation flow, test comment posting flow, test evidence-for filtering on GitLab

Implementation Order

1. Create lib files: retro-ops.lib.sh, github-retro-ops.lib.sh, gitlab-retro-ops.lib.sh
2. Create .src.sh source files from current scripts, source the ops lib, replace gh calls with forge_*
3. Move policies/retro.yaml → policies/github/retro.yaml, create policies/gitlab/retro.yaml
4. Move env/retro.env → env/github/retro.env, create env/gitlab/retro.env
5. Split skills/retro-analysis/ and skills/finding-agent-runs/ into shared + forge subdirs
6. Update harness/retro.yaml with forge.gitlab section
7. Update agents/retro.md, schemas/retro-result.schema.json, docs/retro.md
8. Update Makefile with new BUNDLE_SRCS
9. Run make script-build to generate bundled .sh files
10. Update scripts/post-retro-test.sh with GitLab tests
11. Run make script-test to verify all tests pass

Verification

1. bash scripts/post-retro-test.sh — all existing GitHub tests pass
2. New GitLab test cases pass (mock curl, FULLSEND_FORGE=gitlab)
3. make script-build succeeds (bundled .sh files generated)
4. make script-test passes
5. Schema validates both GitHub and GitLab target_repo patterns

[fullsend-ai-triage]

🤖 Finished Triage · ✅ Success · Started 12:53 PM UTC · Completed 12:57 PM UTC

Commit: 290c351 · View workflow run →

[fullsend-ai-triage]

Triage Summary

Severity: medium · Category: feature

This is a well-specified implementation plan. A few observations that may help the implementer:

Related open work (non-blocking):

• PR feat(#807): make code agent multi-forge (GitHub + GitLab) #813 — code agent multi-forge (for Make code agent multi-forge (GitHub + GitLab) #807), open
• PR feat(#814): make review agent multi-forge (GitHub + GitLab) #815 — review agent multi-forge (for Make review agent multi-forge (GitHub + GitLab) #814), open
• Triage agent multi-forge is already merged on main and provides the reference pattern

The issue correctly notes that the retro agent has no shared library deps with code/review agents and can proceed in parallel.

Existing repo state confirms readiness:

• scripts/lib/triage-ops.lib.sh + github-triage-ops.lib.sh + gitlab-triage-ops.lib.sh are merged and provide the template
• policies/github/triage.yaml and policies/gitlab/triage.yaml demonstrate the policy split pattern
• skills/retro-analysis/ and skills/finding-agent-runs/ currently have only top-level SKILL.md — no forge subdirs yet
• scripts/post-retro.sh and scripts/pre-retro.sh exist as plain .sh files (not yet .src.sh)

Proposed test case:

# GitLab integration tests for post-retro-test.sh
# Set FULLSEND_FORGE=gitlab, GITLAB_TOKEN, GitLab ORIGINATING_URL
# Mock curl responses for GitLab API
# Verify:
# 1. No gh CLI calls when FULLSEND_FORGE=gitlab
# 2. forge_validate_originating_url accepts valid GitLab URLs
# 3. forge_validate_originating_url rejects non-allowed hosts
# 4. forge_parse_originating_url extracts repo/number from GitLab URLs
# 5. forge_create_label/issue/comment use correct GitLab API endpoints
# 6. forge_get_comment_max_len returns 1000000
# 7. All existing GitHub tests pass with FULLSEND_FORGE=github

---

Labels: This is a feature request for adding GitLab support to the retro agent. The enhancement and feature labels match the feature request nature, retro-agent scopes it to the correct agent, and ready-to-code reflects that the implementation spec is complete enough for a developer to start work.

---

Next steps:

• /fs-code — agent creates a PR to implement this issue
• /fs-code <your instruction> — agent implements with your specific guidance

[ggallen]

/fs-code

[fullsend-ai-coder]

🤖 Finished Code · ❌ Failure · Started 12:59 PM UTC · Completed 1:19 PM UTC

Commit: 290c351 · View workflow run →

[fullsend-ai-coder]

⚠️ Post-code script failed — Pre-commit blocked (exit code 1)

The code agent completed, but the post-code script failed before finishing.

Workflow run: https://github.com/fullsend-ai/.fullsend/actions/runs/31885986765

Details:
^------------^ SC2031 (info): FULLSEND_FORGE was modified in a subshell. That change might be lost.

In scripts/post-retro-test.sh line 1058:
    export GITLAB_TOKEN="fake-gitlab-token"
           ^----------^ SC2031 (info): GITLAB_TOKEN [REDACTED] modified in a subshell. That change might be lost.


In scripts/post-retro-test.sh line 1059:
    export ORIGINATING_URL="${url}"
           ^-------------^ SC2031 (info): ORIGINATING_URL was modified in a subshell. That change might be lost.


In scripts/post-retro-test.sh line 1061:
    export CI_PROJECT_DIR="${GL_WORKSPACE}"
           ^------------^ SC2031 (info): CI_PROJECT_DIR was modified in a subshell. That change might be lost.


In scripts/pre-retro.sh line 197:
  ORIGINATING_NUMBER=$(basename "${ORIGINATING_URL}")
  ^----------------^ SC2034 (warning): ORIGINATING_NUMBER appears unused. Verify use (or export if used externally).

For more information:
  https://www.shellcheck.net/wiki/SC2034 -- ORIGINATING_NUMBER appears unused...
  https://www.shellcheck.net/wiki/SC2030 -- Modification of CI_PROJECT_DIR is...
  https://www.shellcheck.net/wiki/SC2031 -- CI_PROJECT_DIR was modified in a ...

Lint GitHub Actions workflow files...................(no files to check)Skipped
pinact (SHA-pin check)...............................(no files to check)Skipped
lint agent doc references and structure..................................Passed

Please check the workflow logs for full details and retry with /fs-code if appropriate.

[ggallen]

/fs-code

Additional implementation notes:

• The pre-commit hooks run shellcheck. Suppress SC2031 in test files where exports happen inside test runner functions (subshell
  context) — use # shellcheck disable=SC2031 on the affected lines or at the function level. See scripts/post-triage-test.sh for
  the established pattern.
• Suppress SC2034 on variables like ORIGINATING_NUMBER that are set by forge_parse functions but consumed in the bundled
  post-script (not visible to shellcheck in the .src.sh file). Use # shellcheck disable=SC2034 with a comment explaining the
  variable is used after bundling. See scripts/pre-triage.src.sh line 22 for the pattern (# shellcheck disable=SC2034 # SCRIPT_DIR used by source in .src.sh; unused in bundled .sh).
• Run make lint before committing to catch shellcheck issues early.

[fullsend-ai-coder]

🤖 Finished Code · ✅ Success · Started 1:37 PM UTC · Completed 1:59 PM UTC

Commit: 290c351 · View workflow run →