feat: add lightweight workflow-edit guard for stale lock files - #44238
Merged
Merged
Conversation
Add scripts/check-stale-lock-files.sh — a fast, binary-free guard that uses git to detect .github/workflows/*.md files modified in the working tree without their .lock.yml being regenerated. - scripts/check-stale-lock-files.sh: git-based staleness check with --dir flag, color-aware output, and clear 'make recompile' remediation - scripts/check-stale-lock-files_test.sh: 8 tests covering clean tree, stale .md, both files modified, missing lock, mixed pairs, custom --dir, and missing directory error cases - Makefile: new check-stale-lock-files target; added to agent-report-progress before the build step for early fast feedback before the heavy drift check Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
Copilot
AI
changed the title
[WIP] Add workflow-edit guard for stale lock files
feat: add lightweight workflow-edit guard for stale lock files
Jul 8, 2026
pelikhan
marked this pull request as ready for review
July 8, 2026 08:46
Collaborator
|
@copilot revert .lock file changes |
Contributor
There was a problem hiding this comment.
Pull request overview
This PR adds a fast, binary-free pre-build guard to catch the common “workflow markdown edited but lock file not regenerated” case early in local validation, and wires it into the agent-report-progress gate to prevent avoidable CI drift failures. It also includes a broad set of regenerated workflow lock files (likely from a recompile) that update embedded MCP config blocks.
Changes:
- Add
scripts/check-stale-lock-files.sh+ test script to detect modified.github/workflows/*.mdwithout corresponding.lock.ymlchanges. - Add
make check-stale-lock-filesand run it first inagent-report-progress. - Regenerate many
.github/workflows/*.lock.ymlfiles (embedded MCP config updates).
Show a summary per file
| File | Description |
|---|---|
| Makefile | Adds check-stale-lock-files target and runs it early in agent-report-progress. |
| scripts/check-stale-lock-files.sh | New lightweight stale lock guard driven by git diff HEAD. |
| scripts/check-stale-lock-files_test.sh | Bash test harness covering common staleness scenarios and --dir. |
| .github/workflows/workflow-normalizer.lock.yml | Regenerated lock file (embedded MCP config updates). |
| .github/workflows/workflow-health-manager.lock.yml | Regenerated lock file (embedded MCP config updates). |
| .github/workflows/workflow-generator.lock.yml | Regenerated lock file (embedded MCP config updates). |
| .github/workflows/weekly-safe-outputs-spec-review.lock.yml | Regenerated lock file (embedded MCP config updates). |
| .github/workflows/weekly-issue-summary.lock.yml | Regenerated lock file (embedded MCP config updates). |
| .github/workflows/weekly-blog-post-writer.lock.yml | Regenerated lock file (embedded MCP config updates). |
| .github/workflows/unbloat-docs.lock.yml | Regenerated lock file (embedded MCP config updates). |
| .github/workflows/uk-ai-operational-resilience.lock.yml | Regenerated lock file (embedded MCP config updates). |
| .github/workflows/ubuntu-image-analyzer.lock.yml | Regenerated lock file (embedded MCP config updates). |
| .github/workflows/tidy.lock.yml | Regenerated lock file (embedded MCP config updates). |
| .github/workflows/terminal-stylist.lock.yml | Regenerated lock file (embedded MCP config updates). |
| .github/workflows/technical-doc-writer.lock.yml | Regenerated lock file (embedded MCP config updates). |
| .github/workflows/sub-issue-closer.lock.yml | Regenerated lock file (embedded MCP config updates). |
| .github/workflows/step-name-alignment.lock.yml | Regenerated lock file (embedded MCP config updates). |
| .github/workflows/stale-repo-identifier.lock.yml | Regenerated lock file (embedded MCP config updates). |
| .github/workflows/stale-pr-cleanup.lock.yml | Regenerated lock file (embedded MCP config updates). |
| .github/workflows/spec-librarian.lock.yml | Regenerated lock file (embedded MCP config updates). |
| .github/workflows/spec-extractor.lock.yml | Regenerated lock file (embedded MCP config updates). |
| .github/workflows/spec-enforcer.lock.yml | Regenerated lock file (embedded MCP config updates). |
| .github/workflows/smoke-update-cross-repo-pr.lock.yml | Regenerated lock file (embedded MCP config updates). |
| .github/workflows/smoke-project.lock.yml | Regenerated lock file (embedded MCP config updates). |
| .github/workflows/smoke-pi.lock.yml | Regenerated lock file (embedded MCP config updates). |
| .github/workflows/smoke-otel-backends.lock.yml | Regenerated lock file (embedded MCP config updates). |
| .github/workflows/smoke-opencode.lock.yml | Regenerated lock file (embedded MCP config updates). |
| .github/workflows/smoke-gemini.lock.yml | Regenerated lock file (embedded MCP config updates). |
| .github/workflows/smoke-crush.lock.yml | Regenerated lock file (embedded MCP config updates). |
| .github/workflows/smoke-create-cross-repo-pr.lock.yml | Regenerated lock file (embedded MCP config updates). |
| .github/workflows/smoke-copilot.lock.yml | Regenerated lock file (embedded MCP config updates). |
| .github/workflows/smoke-copilot-arm.lock.yml | Regenerated lock file (embedded MCP config updates). |
| .github/workflows/smoke-copilot-aoai-entra.lock.yml | Regenerated lock file (embedded MCP config updates). |
| .github/workflows/smoke-copilot-aoai-apikey.lock.yml | Regenerated lock file (embedded MCP config updates). |
| .github/workflows/smoke-codex.lock.yml | Regenerated lock file (embedded MCP config updates). |
| .github/workflows/smoke-claude-on-copilot.lock.yml | Regenerated lock file (embedded MCP config updates). |
| .github/workflows/smoke-ci.lock.yml | Regenerated lock file (embedded MCP config updates). |
| .github/workflows/smoke-antigravity.lock.yml | Regenerated lock file (embedded MCP config updates). |
| .github/workflows/smoke-agent-public-approved.lock.yml | Regenerated lock file (embedded MCP config updates). |
| .github/workflows/skillet.lock.yml | Regenerated lock file (embedded MCP config updates). |
| .github/workflows/security-review.lock.yml | Regenerated lock file (embedded MCP config updates). |
| .github/workflows/security-compliance.lock.yml | Regenerated lock file (embedded MCP config updates). |
| .github/workflows/schema-feature-coverage.lock.yml | Regenerated lock file (embedded MCP config updates). |
| .github/workflows/schema-consistency-checker.lock.yml | Regenerated lock file (embedded MCP config updates). |
| .github/workflows/repository-quality-improver.lock.yml | Regenerated lock file (embedded MCP config updates). |
| .github/workflows/repo-audit-analyzer.lock.yml | Regenerated lock file (embedded MCP config updates). |
| .github/workflows/refiner.lock.yml | Regenerated lock file (embedded MCP config updates). |
| .github/workflows/refactoring-cadence.lock.yml | Regenerated lock file (embedded MCP config updates). |
| .github/workflows/q.lock.yml | Regenerated lock file (embedded MCP config updates). |
| .github/workflows/pr-triage-agent.lock.yml | Regenerated lock file (embedded MCP config updates). |
| .github/workflows/pr-nitpick-reviewer.lock.yml | Regenerated lock file (embedded MCP config updates). |
| .github/workflows/pr-description-caveman.lock.yml | Regenerated lock file (embedded MCP config updates). |
| .github/workflows/pr-code-quality-reviewer.lock.yml | Regenerated lock file (embedded MCP config updates). |
| .github/workflows/plan.lock.yml | Regenerated lock file (embedded MCP config updates). |
| .github/workflows/outcome-collector.lock.yml | Regenerated lock file (embedded MCP config updates). |
| .github/workflows/org-health-report.lock.yml | Regenerated lock file (embedded MCP config updates). |
| .github/workflows/objective-impact-report.lock.yml | Regenerated lock file (embedded MCP config updates). |
| .github/workflows/notion-issue-summary.lock.yml | Regenerated lock file (embedded MCP config updates). |
| .github/workflows/necromancer.lock.yml | Regenerated lock file (embedded MCP config updates). |
| .github/workflows/metrics-collector.lock.yml | Regenerated lock file (embedded MCP config updates). |
| .github/workflows/mergefest.lock.yml | Regenerated lock file (embedded MCP config updates). |
| .github/workflows/mattpocock-skills-reviewer.lock.yml | Regenerated lock file (embedded MCP config updates). |
| .github/workflows/linter-miner.lock.yml | Regenerated lock file (embedded MCP config updates). |
| .github/workflows/lint-monster.lock.yml | Regenerated lock file (embedded MCP config updates). |
| .github/workflows/layout-spec-maintainer.lock.yml | Regenerated lock file (embedded MCP config updates). |
| .github/workflows/jsweep.lock.yml | Regenerated lock file (embedded MCP config updates). |
| .github/workflows/issue-triage-agent.lock.yml | Regenerated lock file (embedded MCP config updates). |
| .github/workflows/issue-arborist.lock.yml | Regenerated lock file (embedded MCP config updates). |
| .github/workflows/instructions-janitor.lock.yml | Regenerated lock file (embedded MCP config updates). |
| .github/workflows/impeccable-skills-reviewer.lock.yml | Regenerated lock file (embedded MCP config updates). |
| .github/workflows/hourly-ci-cleaner.lock.yml | Regenerated lock file (embedded MCP config updates). |
| .github/workflows/grumpy-reviewer.lock.yml | Regenerated lock file (embedded MCP config updates). |
| .github/workflows/gpclean.lock.yml | Regenerated lock file (embedded MCP config updates). |
| .github/workflows/go-logger.lock.yml | Regenerated lock file (embedded MCP config updates). |
| .github/workflows/glossary-maintainer.lock.yml | Regenerated lock file (embedded MCP config updates). |
| .github/workflows/github-remote-mcp-auth-test.lock.yml | Regenerated lock file (embedded MCP config updates). |
| .github/workflows/github-mcp-tools-report.lock.yml | Regenerated lock file (embedded MCP config updates). |
| .github/workflows/github-mcp-structural-analysis.lock.yml | Regenerated lock file (embedded MCP config updates). |
| .github/workflows/functional-pragmatist.lock.yml | Regenerated lock file (embedded MCP config updates). |
| .github/workflows/firewall-escape.lock.yml | Regenerated lock file (embedded MCP config updates). |
| .github/workflows/example-permissions-warning.lock.yml | Regenerated lock file (embedded MCP config updates). |
| .github/workflows/eslint-refiner.lock.yml | Regenerated lock file (embedded MCP config updates). |
| .github/workflows/eslint-monster.lock.yml | Regenerated lock file (embedded MCP config updates). |
| .github/workflows/eslint-miner.lock.yml | Regenerated lock file (embedded MCP config updates). |
| .github/workflows/draft-pr-cleanup.lock.yml | Regenerated lock file (embedded MCP config updates). |
| .github/workflows/discussion-task-miner.lock.yml | Regenerated lock file (embedded MCP config updates). |
| .github/workflows/dictation-prompt.lock.yml | Regenerated lock file (embedded MCP config updates). |
| .github/workflows/dev.lock.yml | Regenerated lock file (embedded MCP config updates). |
| .github/workflows/dev-hawk.lock.yml | Regenerated lock file (embedded MCP config updates). |
| .github/workflows/designer-drift-audit.lock.yml | Regenerated lock file (embedded MCP config updates). |
| .github/workflows/design-decision-gate.lock.yml | Regenerated lock file (embedded MCP config updates). |
| .github/workflows/deployment-incident-monitor.lock.yml | Regenerated lock file (embedded MCP config updates). |
| .github/workflows/dependabot-repair.lock.yml | Regenerated lock file (embedded MCP config updates). |
| .github/workflows/dependabot-go-checker.lock.yml | Regenerated lock file (embedded MCP config updates). |
| .github/workflows/dependabot-burner.lock.yml | Regenerated lock file (embedded MCP config updates). |
| .github/workflows/delight.lock.yml | Regenerated lock file (embedded MCP config updates). |
| .github/workflows/dead-code-remover.lock.yml | Regenerated lock file (embedded MCP config updates). |
| .github/workflows/dataflow-pr-discussion-dataset.lock.yml | Regenerated lock file (embedded MCP config updates). |
| .github/workflows/daily-workflow-updater.lock.yml | Regenerated lock file (embedded MCP config updates). |
| .github/workflows/daily-windows-terminal-integration-builder.lock.yml | Regenerated lock file (embedded MCP config updates). |
| .github/workflows/daily-testify-uber-super-expert.lock.yml | Regenerated lock file (embedded MCP config updates). |
| .github/workflows/daily-team-status.lock.yml | Regenerated lock file (embedded MCP config updates). |
| .github/workflows/daily-spdd-spec-planner.lock.yml | Regenerated lock file (embedded MCP config updates). |
| .github/workflows/daily-semgrep-scan.lock.yml | Regenerated lock file (embedded MCP config updates). |
| .github/workflows/daily-security-red-team.lock.yml | Regenerated lock file (embedded MCP config updates). |
| .github/workflows/daily-security-observability.lock.yml | Regenerated lock file (embedded MCP config updates). |
| .github/workflows/daily-secrets-analysis.lock.yml | Regenerated lock file (embedded MCP config updates). |
| .github/workflows/daily-safeoutputs-git-simulator.lock.yml | Regenerated lock file (embedded MCP config updates). |
| .github/workflows/daily-safe-output-integrator.lock.yml | Regenerated lock file (embedded MCP config updates). |
| .github/workflows/daily-repo-chronicle.lock.yml | Regenerated lock file (embedded MCP config updates). |
| .github/workflows/daily-regulatory.lock.yml | Regenerated lock file (embedded MCP config updates). |
| .github/workflows/daily-performance-summary.lock.yml | Regenerated lock file (embedded MCP config updates). |
| .github/workflows/daily-observability-report.lock.yml | Regenerated lock file (embedded MCP config updates). |
| .github/workflows/daily-model-resolution.lock.yml | Regenerated lock file (embedded MCP config updates). |
| .github/workflows/daily-model-inventory.lock.yml | Regenerated lock file (embedded MCP config updates). |
| .github/workflows/daily-mcp-concurrency-analysis.lock.yml | Regenerated lock file (embedded MCP config updates). |
| .github/workflows/daily-malicious-code-scan.lock.yml | Regenerated lock file (embedded MCP config updates). |
| .github/workflows/daily-issues-report.lock.yml | Regenerated lock file (embedded MCP config updates). |
| .github/workflows/daily-geo-optimizer.lock.yml | Regenerated lock file (embedded MCP config updates). |
| .github/workflows/daily-formal-spec-verifier.lock.yml | Regenerated lock file (embedded MCP config updates). |
| .github/workflows/daily-firewall-report.lock.yml | Regenerated lock file (embedded MCP config updates). |
| .github/workflows/daily-file-diet.lock.yml | Regenerated lock file (embedded MCP config updates). |
| .github/workflows/daily-fact.lock.yml | Regenerated lock file (embedded MCP config updates). |
| .github/workflows/daily-experiment-report.lock.yml | Regenerated lock file (embedded MCP config updates). |
| .github/workflows/daily-doc-updater.lock.yml | Regenerated lock file (embedded MCP config updates). |
| .github/workflows/daily-doc-healer.lock.yml | Regenerated lock file (embedded MCP config updates). |
| .github/workflows/daily-compiler-threat-spec-optimizer.lock.yml | Regenerated lock file (embedded MCP config updates). |
| .github/workflows/daily-compiler-quality.lock.yml | Regenerated lock file (embedded MCP config updates). |
| .github/workflows/daily-community-attribution.lock.yml | Regenerated lock file (embedded MCP config updates). |
| .github/workflows/daily-code-metrics.lock.yml | Regenerated lock file (embedded MCP config updates). |
| .github/workflows/daily-cli-performance.lock.yml | Regenerated lock file (embedded MCP config updates). |
| .github/workflows/daily-choice-test.lock.yml | Regenerated lock file (embedded MCP config updates). |
| .github/workflows/daily-cache-strategy-analyzer.lock.yml | Regenerated lock file (embedded MCP config updates). |
| .github/workflows/daily-assign-issue-to-user.lock.yml | Regenerated lock file (embedded MCP config updates). |
| .github/workflows/daily-ambient-context-optimizer.lock.yml | Regenerated lock file (embedded MCP config updates). |
| .github/workflows/daily-agent-of-the-day-blog-writer.lock.yml | Regenerated lock file (embedded MCP config updates). |
| .github/workflows/craft.lock.yml | Regenerated lock file (embedded MCP config updates). |
| .github/workflows/copilot-session-insights.lock.yml | Regenerated lock file (embedded MCP config updates). |
| .github/workflows/copilot-pr-prompt-analysis.lock.yml | Regenerated lock file (embedded MCP config updates). |
| .github/workflows/copilot-pr-nlp-analysis.lock.yml | Regenerated lock file (embedded MCP config updates). |
| .github/workflows/copilot-opt.lock.yml | Regenerated lock file (embedded MCP config updates). |
| .github/workflows/copilot-cli-deep-research.lock.yml | Regenerated lock file (embedded MCP config updates). |
| .github/workflows/copilot-agent-analysis.lock.yml | Regenerated lock file (embedded MCP config updates). |
| .github/workflows/contribution-check.lock.yml | Regenerated lock file (embedded MCP config updates). |
| .github/workflows/commit-changes-analyzer.lock.yml | Regenerated lock file (embedded MCP config updates). |
| .github/workflows/codex-github-remote-mcp-test.lock.yml | Regenerated lock file (embedded MCP config updates). |
| .github/workflows/code-simplifier.lock.yml | Regenerated lock file (embedded MCP config updates). |
| .github/workflows/code-scanning-fixer.lock.yml | Regenerated lock file (embedded MCP config updates). |
| .github/workflows/ci-doctor.lock.yml | Regenerated lock file (embedded MCP config updates). |
| .github/workflows/ci-coach.lock.yml | Regenerated lock file (embedded MCP config updates). |
| .github/workflows/breaking-change-checker.lock.yml | Regenerated lock file (embedded MCP config updates). |
| .github/workflows/bot-detection.lock.yml | Regenerated lock file (embedded MCP config updates). |
| .github/workflows/avenger.lock.yml | Regenerated lock file (embedded MCP config updates). |
| .github/workflows/artifacts-summary.lock.yml | Regenerated lock file (embedded MCP config updates). |
| .github/workflows/archie.lock.yml | Regenerated lock file (embedded MCP config updates). |
| .github/workflows/approach-validator.lock.yml | Regenerated lock file (embedded MCP config updates). |
| .github/workflows/ai-moderator.lock.yml | Regenerated lock file (embedded MCP config updates). |
| .github/workflows/agentic-token-optimizer.lock.yml | Regenerated lock file (embedded MCP config updates). |
| .github/workflows/agent-performance-analyzer.lock.yml | Regenerated lock file (embedded MCP config updates). |
| .github/workflows/ab-testing-advisor.lock.yml | Regenerated lock file (embedded MCP config updates). |
Review details
Tip
Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
- Files reviewed: 197/197 changed files
- Comments generated: 1
- Review effort level: Low
Comment on lines
+71
to
+75
| # Filter to .md files within the workflows directory. | ||
| # Strip a leading "./" from WORKFLOWS_DIR for consistent prefix matching. | ||
| workflows_prefix="${WORKFLOWS_DIR#./}" | ||
| modified_mds=$(printf '%s\n' "$all_modified" | grep "^${workflows_prefix}.*\.md$" || true) | ||
|
|
Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
Contributor
Author
Done. All 194 regenerated |
Contributor
|
🎉 This pull request is included in a new release. Release: |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Agents repeatedly edit
.github/workflows/*.mdfiles without recompiling the corresponding.lock.yml, causing avoidable CI failures caught only by the heavycheck-workflow-driftjob (which requires a full recompile).Changes
scripts/check-stale-lock-files.sh— new binary-free guard usinggit diff HEADto detect modified.mdfiles whose.lock.ymlwas not also modified. Exits 0 on a clean checkout (no false positives on fresh clones); exits 1 with amake recompileremediation message on staleness. Supports--diroverride.scripts/check-stale-lock-files_test.sh— 8 tests: clean tree, stale.md, both files modified, missing.lock.yml, mixed pairs,--dirflag, remediation text, missing directory.Makefile— newcheck-stale-lock-filestarget; inserted as the first step inagent-report-progressso agents get early fast failure before the binary is even built.How it fits alongside the existing drift check
check-stale-lock-filescheck-workflow-driftagent-report-progress.mdwithout matching.lock.ymlThe two checks are complementary: the new one is the fast early gate; the existing one remains the authoritative final verification.