Change protected-files policy to 'allowed' for labelops-pr-maintenance workflow#19783
Change protected-files policy to 'allowed' for labelops-pr-maintenance workflow#19783Copilot wants to merge 2 commits into
Conversation
…e workflow The workflow resolves merge conflicts by merging from main, which naturally includes changes to protected files. The previous 'fallback-to-issue' policy blocked these normal merge operations. The prompt still has "Never modify .github/**" as a hard rule to prevent the agent from inventing changes. Agent-Logs-Url: https://github.com/dotnet/fsharp/sessions/504efc52-c37e-4a2c-9492-b496e7061d77 Co-authored-by: T-Gro <46543583+T-Gro@users.noreply.github.com>
T-Gro
left a comment
T-Gro
left a comment
There was a problem hiding this comment.
Review
The change itself is mechanically correct — allback-to-issue was indeed blocking merge commits that carry upstream .github/** changes, and �llowed unblocks that.
One issue: stale documentation in the same file.
Line 63 of labelops-pr-maintenance.md still says:
- Never modify
.github/**. Protected byfallback-to-issue.
This is now inaccurate since the enforcement layer was removed. It should be updated to reflect the current guardrail (prompt-level hard rule only), e.g.:
- Never modify
.github/**. (prompt-enforced; safe-outputs allows it for merge commits from upstream)
Otherwise the next person reading the workflow source will assume there's still a compile-time policy backing that rule.
Minor security note: moving from policy enforcement to prompt-only enforcement reduces defense-in-depth. If there's ever a protected-files: allow-from-merge option (or similar), that would be the ideal middle ground. For now, the tradeoff seems acceptable given the workflow's limited scope.
LGTM with the doc fix above.
✅ No release notes required |
The
labelops-pr-maintenanceworkflow merges frommainto resolve conflicts, which naturally includes upstream changes to protected files in the merge commit. Thefallback-to-issuepolicy was treating these as agent-invented modifications and blocking the push.protected-files: fallback-to-issue→protected-files: allowedin safe-outputs configThe prompt-level hard rule ("Never modify
.github/**") remains the guardrail against the agent inventing changes to protected files. The safe-outputs enforcement is the wrong layer for this — merge commits from upstream are not agent decisions.