[fullsend-ai-coder]

The validate-output-schema.sh script runs on the runner host (not inside the sandbox container) via the harness validation_loop. It requires the Python jsonschema package, which is not pre-installed on ubuntu-latest runners.

Previously, both triage.yml and review.yml had their own "Install validation dependencies" steps to pip-install jsonschema. This was fragile — any new workflow using validate-output-schema.sh would need to remember the same step.

Move the pip install into the fullsend composite action (action.yml) so it runs automatically for all agent workflows. Remove the now-redundant steps from the triage and review workflow files.

Closes #340

Changed files

• internal/scaffold/fullsend-repo/.github/actions/fullsend/action.yml
• internal/scaffold/fullsend-repo/.github/workflows/review.yml
• internal/scaffold/fullsend-repo/.github/workflows/triage.yml

---

Closes #340

Post-script verification

• Branch is not main/master (agent/340-move-jsonschema-install)
• Secret scan passed (gitleaks — 3ba696a340b23c251b0f960bb6f29cb652bd8e69..HEAD)
• Pre-commit hooks passed (authoritative run on runner)
• Tests ran inside sandbox

_{Created by fullsend code agent}

[github-actions]

Site preview

Preview: https://3c603579-site.fullsend-ai.workers.dev

Commit: 58aa0bcaef623aa80e6779074f1331c532738982

[fullsend-ai-review]

Review: #441

Head SHA: 58aa0bc
Timestamp: 2026-04-24T20:30:00Z
Outcome: approve

Summary

Clean consolidation that moves the jsonschema pip install from two individual workflow files (review.yml, triage.yml) into the shared fullsend composite action (action.yml). The change is mechanically correct — the same pip install --quiet "jsonschema>=4.18.0" command now runs once in the composite action rather than being duplicated per workflow. This also fixes a latent gap: code.yml uses the fullsend action but never had this install step, so it would have failed if the validation script ran during a code agent job.

No correctness, security, or injection findings. The diff exactly matches the issue's recommended action item.

Findings

No critical, high, medium, low, or info findings.

Footer

Outcome: approve
This review applies to SHA 58aa0bcaef623aa80e6779074f1331c532738982. Any push to the PR head clears this review and requires a new evaluation.