Pin the Runtime Imports Before an Agent Adds a Paid Client

Description and use

CI import check blocks paid‑service imports, preventing accidental billing.

Problem

Automated code changes can add paid‑service imports that increase cloud costs before a human review.

Outcome

The workflow blocks any new paid‑service imports until a human reviews and updates the allowlist, keeping costs under control.

Workflow

• Create import_allowlist.json with allowed modules and banned dynamic roots.
• Write scan_imports.py to walk ASTs and collect top‑level imports.
• Configure CI to run scan_imports.py before tests.
• If the script exits with code 1, the CI build fails and the PR is blocked.
• Review the PR to either remove the import or update the allowlist with human approval.

Evidence

Fail CI when app code imports a root outside import_allowlist.json.

Source