Build a Path Deny List Before Your First Agent PR

Описание и применение

Создайте локальный список запрещённых путей и скрипт pre‑commit, чтобы предотвратить изменение критических файлов агентом в первом PR.

Задача

Agents can unintentionally modify critical files (secrets, lockfiles, CI configs) in a first PR, causing merge risks and security leaks.

Результат

The workflow prevents accidental agent edits to critical paths by enforcing a local deny list and pre-commit check, reducing merge risk and secret leakage.

Рабочий процесс

• Clone repo and inspect tree
• Run find to list dangerous files
• Create .agent-untouchable with patterns
• Copy deny file to home for backup
• Write check-untouchable.sh to compare staged files against deny list
• Make script executable
• Optionally add pre-commit hook to run checker
• Test checker by staging a frozen file and verifying failure

Доказательства

Agents will chase a green local run. They do not share your merge risk.

Источник

Frozen paths never enter the agent context window.

Источник