If the Agent Touches .github, Fail the Job. Then Measure Coverage Delta.

说明与用途

自动化代理可能会修改 CI 文件以隐藏回归。此方案阻止在同一 PR 中修改 .github/ 及相关文件，要求单独 PR 并通过 CODEOWNERS 审核，并与 merge‑base 比较覆盖率差异。

问题

Automated agents can modify CI pipeline files in a PR, allowing them to hide regressions or skip checks, undermining merge quality.

结果

PRs that modify pipeline files are now blocked from merging with product changes, and coverage regressions are detected by comparing coverage against the merge base.

工作流

• 1. Create a deny list file (ci/pipeline-deny.txt) listing paths that should not be edited in the same PR as product code.
• 2. Add a workflow (.github/workflows/pipeline-freeze.yml) that runs on PR events and executes a script (scripts/ci/deny_pipeline_paths.sh) to fail if any denied paths are changed.
• 3. Configure CODEOWNERS to require human review for the denied paths.
• 4. Add a coverage-delta job that runs after pipeline-freeze, checks out the repo, runs tests on both BASE and HEAD, and compares coverage totals, failing if the delta exceeds a budget.
• 5. Ensure the pipeline-freeze job is a required status check in branch protection rules.
• 6. Keep the deny list and budget hardcoded; never let an agent modify them.

证据

If the PR diff touches .github/, CODEOWNERS, coverage config, or the scripts that compute the delta, fail a dedicated job named pipeline-freeze.

来源

Fail if the PR edits the merge contract

来源