If the Agent Touches .github, Fail the Job. Then Measure Coverage Delta.

Описание и применение

Автоматизированные агенты могут изменять файлы CI, скрывая регрессии. Внедрённый рецепт блокирует изменения в .github/ и связанных файлах, требуя отдельный PR и проверки CODEOWNERS, а также измеряет разницу покрытия по сравнению с merge‑base.

Задача

Automated agents can modify CI pipeline files in a PR, allowing them to hide regressions or skip checks, undermining merge quality.

Результат

PRs that modify pipeline files are now blocked from merging with product changes, and coverage regressions are detected by comparing coverage against the merge base.

Рабочий процесс

• 1. Create a deny list file (ci/pipeline-deny.txt) listing paths that should not be edited in the same PR as product code.
• 2. Add a workflow (.github/workflows/pipeline-freeze.yml) that runs on PR events and executes a script (scripts/ci/deny_pipeline_paths.sh) to fail if any denied paths are changed.
• 3. Configure CODEOWNERS to require human review for the denied paths.
• 4. Add a coverage-delta job that runs after pipeline-freeze, checks out the repo, runs tests on both BASE and HEAD, and compares coverage totals, failing if the delta exceeds a budget.
• 5. Ensure the pipeline-freeze job is a required status check in branch protection rules.
• 6. Keep the deny list and budget hardcoded; never let an agent modify them.

Доказательства

If the PR diff touches .github/, CODEOWNERS, coverage config, or the scripts that compute the delta, fail a dedicated job named pipeline-freeze.

Источник

Fail if the PR edits the merge contract

Источник