feat(flue): port skill-drift system to Flue framework (side-by-side)

[HazAT]

Caution

This PR still depends on the @mistralai/mistralai supply-chain mitigation work; keep the PR in Draft until the advisory requirement is fully satisfied.

Summary

Ports Flue skill-drift from a centralized weekly scheduler in this repo to an inverted architecture: each SDK repo runs its own per-PR detector trigger and invokes a shared reusable workflow in sentry-for-ai.

What's in this PR

• Reusable Detector workflow in this repo: .github/workflows/flue-skill-drift-detector-reusable.yml
• 19 SDK-repo wrapper templates in docs/agent-port/sdk-repo-wrappers/
• Updater + Creator as local CLI tools only:
  • ./scripts/test-flue-updater.sh
  • ./scripts/test-flue-creator.sh
• Full Flue project scaffold and supply-chain mitigation (@mistralai/mistralai) remaining intact

Architecture

┌───────────────────────────────────────────────────────────────┐
│ Per-SDK-repo workflow (e.g. getsentry/sentry-android)         │
│ on: pull_request: types: [closed]                             │
│ if: pull_request.merged == true                               │
│ uses: getsentry/sentry-for-ai/.github/workflows/                │
│   flue-skill-drift-detector-reusable.yml@main                 │
└───────────────────┬───────────────────────────────────────────┘
                    │ workflow_call with skill_name, sdk_repo,
                    │ pr_number, pr_url
                    ▼
┌───────────────────────────────────────────────────────────────┐
│ Reusable workflow in getsentry/sentry-for-ai                  │
│ • detect job: checkout SDK + skills repo, run Flue agent,     │
│   output JSON actions array                                    │
│ • actuate job: apply patches, open PRs/issues in              │
│   getsentry/sentry-for-ai via GitHub App token                │
└───────────────────────────────────────────────────────────────┘
                    │ (skill-drift labeled PR opens)
                    ▼
┌───────────────────────────────────────────────────────────────┐
│ skill-drift-assign-reviewers.yml (unchanged)                  │
│ Routes the PR to the right SDK team based on changed paths    │
└───────────────────────────────────────────────────────────────┘

Separately (local-only, no CI trigger):
┌───────────────────────────────────────────────────────────────┐
│ Updater & Skill Creator                                        │
│ Invoked via ./scripts/test-flue-updater.sh and                │
│ ./scripts/test-flue-creator.sh                                │
│ Edits files locally; human reviews and opens PR manually       │
└───────────────────────────────────────────────────────────────┘

How to test locally

• Updater: ./scripts/test-flue-updater.sh [--issue <N>|--fixture]
• Creator: ./scripts/test-flue-creator.sh <platform> [prompt]
• Detector:
  • ./scripts/test-flue-detector.sh <skill_name> <sdk_repo> <pr_number> [sdk_repo_path]
  • or run a normal SDK PR merge when wrappers are onboarded

Pending follow-ups

• Complete per-repo detector rollout by adding the wrapper workflow to the 19 SDK repos and validating output.
• Remove old gh-aw-specific docs and assets only after all per-repo detectors are stable.

Review findings

Type	File	Notes
commit	3c0d201	removed Updater + Creator GH-Actions workflows; kept tools local only
commit	e47071b	redesigned Detector for single-PR, single-skill invocation
commit	27367df	converted Detector to reusable workflow + added per-repo wrappers

[sentry]

Bug: The workflow captures stderr from build-skill-tree.sh, but the script writes its errors to stdout, resulting in empty error reports on validation failure.
_{Severity: MEDIUM}

Suggested Fix

Modify the command in the workflow to capture both stdout and stderr. Change ./scripts/build-skill-tree.sh --check 2>/tmp/skill-tree-err to ./scripts/build-skill-tree.sh --check &> /tmp/skill-tree-err. This will redirect both streams to the file, ensuring the $ERR variable contains the actual error messages.

Prompt for AI Agent

Review the code at the location below. A potential bug has been identified by an AI
agent. Verify if this is a real issue. If it is, propose a fix; if not, explain why it's
not valid.

Location: .github/workflows/flue-skill-drift-updater.yml#L189-L192

Potential issue: The `build-skill-tree.sh` script writes its validation error messages
to `stdout`. However, the calling GitHub workflow only captures `stderr` by using the
redirection `2>/tmp/skill-tree-err`. When the script fails due to validation errors, the
captured `$ERR` variable is empty. Consequently, the GitHub issue comment created to
report the failure contains an empty code block, providing no actionable information for
developers to debug why the skill tree validation failed.

Also affects:

• .github/workflows/flue-skill-creator.yml:188~191

[sentry]

Bug: The allowlist check uses git diff --name-only, which does not detect new untracked files. This could allow a patch to create and commit files outside the allowed directory.
_{Severity: MEDIUM}

Suggested Fix

Replace git diff --name-only with a command that can detect all changes, including untracked files. Use git status --porcelain and parse its output to get a list of all modified, staged, and untracked files to ensure the allowlist check is comprehensive.

Prompt for AI Agent

Review the code at the location below. A potential bug has been identified by an AI
agent. Verify if this is a real issue. If it is, propose a fix; if not, explain why it's
not valid.

Location: .github/workflows/flue-skill-drift-detector.yml#L123

Potential issue: The workflow's security check uses `git diff --name-only` to identify
modified files and verify they are within an allowed directory. However, this command
does not list new, untracked files. A patch applied via `git apply` can create new
files. If a patch creates a new, untracked file outside the allowed `skills/` directory,
it will bypass this security check. The subsequent `git add -A` command will then stage
and commit this untracked file, potentially introducing unauthorized code.

[sentry]

Bug: The jq command in test-flue-detector.sh is missing the -n flag, causing the script to hang indefinitely when run without the --fixture option.
_{Severity: HIGH}

Suggested Fix

Add the -n flag to the jq command on line 47 to prevent it from reading from standard input. Change jq -c \ to jq -c -n \.

Prompt for AI Agent

Review the code at the location below. A potential bug has been identified by an AI
agent. Verify if this is a real issue. If it is, propose a fix; if not, explain why it's
not valid.

Location: scripts/test-flue-detector.sh#L47-L53

Potential issue: The `scripts/test-flue-detector.sh` script will hang indefinitely when
invoked in its primary, documented, non-fixture mode. The `jq` command on line 47 is
called without the `-n` flag and without any piped input or input file. This causes `jq`
to wait for input from stdin, which is never provided within the `$(...)` command
substitution. As a result, the script execution stalls and never completes.

[cursor]

Cursor Bugbot has reviewed your changes and found 3 potential issues.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit ec41145. Configure here.}

[cursor]

Actuate job reads artifact from wrong path

High Severity

The download-artifact step (no working-directory) places result.json at $GITHUB_WORKSPACE/artifact/result.json. The "Apply actions" step runs with working-directory: skills-repo and sets RESULT="artifact/result.json", resolving to $GITHUB_WORKSPACE/skills-repo/artifact/result.json — a path that never exists. Under set -euo pipefail, jq will fail immediately and no actions are ever applied.

Additional Locations (1)

• .github/workflows/flue-skill-drift-detector-reusable.yml#L143-L148

 

^{Reviewed by Cursor Bugbot for commit ec41145. Configure here.}

[cursor]

Downgrade issue body contains literal \n instead of newlines

Low Severity

The issue_body variable for the protected-path downgrade uses \n inside regular double quotes. Bash doesn't interpret \n as newlines in "..." strings — they stay literal. Use $'...\n...' quoting or printf (as add_reference_footer already does) to produce actual line breaks in the created GitHub issue.

 

^{Reviewed by Cursor Bugbot for commit ec41145. Configure here.}

[cursor]

JavaScript wrappers use mutually exclusive path filters

High Severity

All 8 sentry-javascript-*.yml wrapper templates specify both paths-ignore and paths on the same pull_request event. GitHub Actions rejects this combination — these filters are mutually exclusive per event. Workflows copied from these templates will fail validation and never trigger. Use a single paths list with ! negation patterns instead (e.g., !**/*.md).

Additional Locations (2)

• docs/agent-port/sdk-repo-wrappers/sentry-javascript-cloudflare.yml#L6-L17
• docs/agent-port/sdk-repo-wrappers/sentry-javascript-nextjs.yml#L6-L19

 

^{Reviewed by Cursor Bugbot for commit ec41145. Configure here.}

[sentry-warden]

Known-malware package executes before postinstall cleanup in CI, exposing GITHUB_TOKEN

The postinstall hook removing @mistralai/mistralai (GHSA-3q49-cfcf-g5fm) runs only after npm has already installed all packages and executed their own lifecycle scripts, so any malicious install hooks in that package fire first — during npm ci in the reusable workflow where GITHUB_TOKEN is available in the runner environment.

Evidence

• package-lock.json confirms @mistralai/mistralai@2.2.1 as a resolved transitive dependency via node_modules/@mariozechner/pi-ai (line 1378 lists "@mistralai/mistralai": "^2.2.0" under its deps; package-lock line 1394 resolves it to 2.2.1).
• npm's lifecycle execution order guarantees all dependency install scripts run before the root package's postinstall, so the malware can execute before rm -rf node_modules/@mistralai/mistralai removes it.
• The reusable workflow flue-skill-drift-detector-reusable.yml runs npm ci (Install Flue step, detect job) without suppressing install scripts; GITHUB_TOKEN is available as an environment variable to all steps in that job, including during package installation.
• The PR description explicitly acknowledges the mitigation is incomplete: "This PR still depends on the @mistralai/mistralai supply-chain mitigation work; keep the PR in Draft until the advisory requirement is fully satisfied."
• The postinstall script does nothing to prevent execution of @mistralai/mistralai's own lifecycle hooks and provides a false sense of mitigation.

_{Identified by Warden security-review · 238-9D5}