Pattern quality: Add protected-files guidance to dependency-monitor pattern - #251
Merged
pelikhan merged 2 commits intoSep 2, 2026
Conversation
dependency-monitor is the only archetype recommending create-pull-request that lacked protected-files guidance in its pattern tips, even though the wizard's protectedFilesTips() generator function exists specifically to surface this for archetypes that open unattended pull requests. This left generated dependency-monitor workflow prompts without a guard against an unreviewed scheduled PR touching CI configuration or agent instructions while bumping dependency manifests. Adds a scoped tip (protecting CI config/agent instructions, not the manifests being intentionally updated) to patterns/archetypes/dependency-monitor.json and the corresponding generator in scripts/generate-patterns.py, plus test coverage in workflow.test.js and generate-patterns.test.js. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
pelikhan
marked this pull request as ready for review
September 2, 2026 23:32
…-files-aedf43978be228cd
pelikhan
deleted the
pattern-quality-dependency-monitor-protected-files-aedf43978be228cd
branch
September 2, 2026 23:32
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
Contributor
Author
There was a problem hiding this comment.
Reviewer kind: auto → matt-pocock (JS/JSON pattern-data and test changes; no HTML/UI/content touched).
No blocking issues found. Change is minimal, consistent with the existing pattern (mirrors tips already present on other PR-creating archetypes), and is covered by corresponding test updates in test/generate-patterns.test.js and test/workflow.test.js. No correctness, type-safety, or test-coverage concerns.
Generated by Specialist PR Review for #251 · copilot · auto · 13.9 AIC · ⌖ 4.79 AIC · ⊞ 8.1K
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Evaluation
Evaluated the 6 samples in
/tmp/gh-aw/data/generated-patterns-and-prompts.jsonagainstpatterns/manifest.json,patterns/workflow-generation.json,patterns/archetypes/*.json, and the generator logic insrc/js/workflow.js.Recurring quality issue found
dependency-monitorrecommendscreate-pull-request(it opens unattended pull requests bumping dependency manifests on a schedule), but its pattern tips were missingprotected-filesguidance. Every other archetype in the pattern library that recommendscreate-pull-request(code-improvement,documentation-updater,linter-applier,performance-nut) already carries this tip, andsrc/js/workflow.jshas a dedicatedprotectedFilesTips()function whose purpose is specifically to surface it into the generated prompt for archetypes that open PRs unattended — but with no matching tip in the pattern data,dependency-monitor's generated prompt silently skipped this guard. Confirmed against the sample:dependency-monitor-daily's generated prompt had no protected-files/fallback-to-issuemention, unlikecode-improvement-daily's anddocumentation-updater-push's prompts.Without this guard, a scheduled dependency-monitor workflow could open an unreviewed PR that also touches CI configuration or agent instruction files while updating manifests.
What changed
patterns/archetypes/dependency-monitor.json: added a tip recommendingprotected-files: fallback-to-issuefor CI configuration and agent instructions (deliberately scoped to exclude the dependency manifests themselves, since editing those is the intended change for this archetype).scripts/generate-patterns.py: added the same tip to the generator so future pattern regeneration retains it.test/workflow.test.js: extended the existing "surfaces protected-files guidance for archetypes that open unattended PRs" test to also assert this fordependency-monitor.test/generate-patterns.test.js: added an assertion that regenerateddependency-monitortips still containprotected-files.Validation
npm test: 318/318 tests passed (18 test files).npm run build: succeeded,dist/patterns/archetypes/dependency-monitor.jsonregenerated with the new tip.Follow-ups deliberately left out
agent-cost-tracker,pr-iteration-loop) also lack a protected-files tip despite listingpull-requestsas a safe output; left out of this PR to keep the change minimal and because their triggers/paths differ enough to warrant separate review of scope (e.g.agent-cost-trackerusesworkflow_run, already flagged elsewhere as a risky trigger).