Coding agent should use a fork

[deboer-tim]

Most GitHub projects use forks for all contributions. Beside keeping the main repo much cleaner when there are multiple contributors, GitHub forks use an entirely different 'open source' security model. Forks do not have access to the repo's secrets and can't modify the main repo (until merged).

To enhance security, match what teams are doing today, and follow GitHub's standards, the coding agent should have the ability to use a fork for all PRs.

[rh-hemartin]

/fs-triage

[fullsend-ai-triage]

🤖 Finished Triage · ✅ Success · Started 7:50 AM UTC · Completed 7:54 AM UTC
Commit: 7ada4e0 · View workflow run →

[fullsend-ai-triage]

Triage Assessment

This is a well-motivated feature request. The benefits are clear: enhanced security via GitHub's fork trust boundary, cleaner enrolled repos (no orphaned agent branches), and alignment with GitHub's standard contribution model.

Blocking dependency

Implementation requires platform-level changes tracked in fullsend-ai/fullsend#5020, which describes the same problem from an operational angle (orphaned agent branches accumulating on enrolled repos). That issue proposes two complementary approaches:

• Option A (branch cleanup): Delete agent branches after PR close — addresses the symptom
• Option B (fork workflow): Switch the code agent to use a fork — addresses the root cause (this issue)

Option B requires platform changes before the agents repo post-scripts can switch to fork-based push:

1. Fork lifecycle management — creating and maintaining forks for each enrolled repo
2. Token provisioning — the current PUSH_TOKEN is scoped to the enrolled repo; fork-based push needs write access to the fork
3. PR creation — cross-repo PRs from fork to upstream

The post-code.sh script currently hardcodes git remote set-url origin to the enrolled repo and pushes directly. These changes are straightforward once the platform provides fork infrastructure, but cannot land independently.

Related work

Multiple fork-related issues are active in the fullsend platform repo (fork dispatch, fork PR review, ephemeral forks for testing), indicating fork support is an active area of development. This issue aligns well with that direction.

Recommendation

This issue should be unblocked once fullsend-ai/fullsend#5020 Option B (fork workflow) has platform support. At that point, the agents repo changes are primarily in scripts/post-code.src.sh (and the fix agent equivalent) to push to a fork remote instead of the enrolled repo.

Blocked by:

• Code agent leaves orphaned branches on enrolled repos instead of using fork workflow fullsend#5020

[rh-hemartin]

Hm Hm... so it does make sense to me to contribute as a fork, however there are logistic problems with this for example the coder agent should be installed on that fork to be able to push.