fix(ci): harden daily-doc-updater workflow guardrails#220
Merged
YousefHadder merged 2 commits intomainfrom Mar 7, 2026
Merged
Conversation
- Fix bash allowlist to reference actual repo paths (doc/*.txt not docs/*.md) so the agent can read the vimdoc file - Add types.lua to allowlist for config schema awareness - Add Critical Rules section with CHANGELOG guard, file scope limits, wiki-aware README guidance, and conventional commit format - Switch PRs to draft with auto-merge disabled for human review - Fix broken grep pattern and reduce timeout from 45m to 15m - Include auto-generated agentics-maintenance workflow
Contributor
There was a problem hiding this comment.
Pull request overview
This PR hardens the daily-doc-updater agentic workflow by fixing several gaps that caused it to reference wrong paths, potentially edit protected files, and auto-merge AI-generated changes without human review. The changes also produce a new auto-generated agentics-maintenance.yml workflow as a side effect of gh aw compile.
Changes:
- Fixes the bash allowlist in
daily-doc-updater.mdto reference the correct paths (doc/notdocs/,*.txtnot*.md/*.mdx), addstypes.luaaccess, fixes the brokengrepglob, reduces timeout from 45m to 15m, and switches PRs to draft/no-auto-merge - Adds guardrails in the agent prompt: CHANGELOG.md protection, README lightweight policy, conventional commit format, and wiki-linking guidance
- Introduces auto-generated
agentics-maintenance.ymlworkflow (produced bygh aw compile) and updates the compileddaily-doc-updater.lock.ymlto reflect all source changes
Reviewed changes
Copilot reviewed 3 out of 3 changed files in this pull request and generated 2 comments.
| File | Description |
|---|---|
.github/workflows/daily-doc-updater.md |
Source workflow: fixes bash allowlist, adds critical rules (CHANGELOG, README, commit format), updates file routing guidance, switches to draft PRs |
.github/workflows/daily-doc-updater.lock.yml |
Auto-generated compiled lockfile reflecting all changes from the .md source |
.github/workflows/agentics-maintenance.yml |
New auto-generated maintenance workflow that closes expired PRs/issues/discussions on a schedule |
Addresses review feedback — the auto-generated maintenance workflow from gh-aw compile should get the same .gitattributes treatment as the .lock.yml files to prevent merge conflicts and exclude it from language statistics.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes several gaps in the daily-doc-updater agentic workflow that would cause it to fail or produce bad results.
docs/*.mdand*.mdxbut the repo usesdoc/markdown-plus.txt(a.txtfile). The agent literally couldn't read the vimdoc file it was supposed to update.CHANGELOG.mdwhich is auto-generated by release-please — added explicit "never touch" rules.draft: true/auto-merge: falseso AI-generated vimdoc changes get human review before merging.docs(scope): description).grep -r '*'was shell-expanding the glob — replaced withgrep -rn '' doc README.md.agentics-maintenance.ymlis auto-generated bygh aw compile— it runs every 2 hours to close expired PRs/issues/discussions created bysafe-outputs. Added to.gitattributesaslinguist-generated.Tested by running
gh aw compile— compiles cleanly with 0 errors, 0 warnings.