If the Agent Touches .github, Fail the Job. Then Measure Coverage Delta.

Description and use

Automated agents can modify CI files to hide regressions. This recipe blocks changes to .github/ and related files, requires a separate PR with CODEOWNERS review, and measures coverage delta against the merge base.

Problem

Automated agents can modify CI pipeline files in a PR, allowing them to hide regressions or skip checks, undermining merge quality.

Outcome

PRs that modify pipeline files are now blocked from merging with product changes, and coverage regressions are detected by comparing coverage against the merge base.

Workflow

• 1. Create a deny list file (ci/pipeline-deny.txt) listing paths that should not be edited in the same PR as product code.
• 2. Add a workflow (.github/workflows/pipeline-freeze.yml) that runs on PR events and executes a script (scripts/ci/deny_pipeline_paths.sh) to fail if any denied paths are changed.
• 3. Configure CODEOWNERS to require human review for the denied paths.
• 4. Add a coverage-delta job that runs after pipeline-freeze, checks out the repo, runs tests on both BASE and HEAD, and compares coverage totals, failing if the delta exceeds a budget.
• 5. Ensure the pipeline-freeze job is a required status check in branch protection rules.
• 6. Keep the deny list and budget hardcoded; never let an agent modify them.

Evidence

If the PR diff touches .github/, CODEOWNERS, coverage config, or the scripts that compute the delta, fail a dedicated job named pipeline-freeze.

Source

Fail if the PR edits the merge contract

Source