Chock.sh Build your plugin
Coding agents
Asksv0.2.7 preset: CI pipeline

Protect CI Workflows

Refuses a matched shell command before it runs. Asks on an agent's file writes and at turn end.

Acts on

Shell command · File write · Turn end

When

Before the command runs · before the file write · at turn end

Tested

63 of 63 pass

In a git repo

In agent

What it does

Asks a person before an agent weakens the checks that review its work. Shell guard refuses writes to .github/workflows/, .github/actions/, .github/dependabot.y*ml (redirect, rm/mv/tee/sed -i, cp into, git checkout/restore, cmdlets); reads and chock sync pass. Edit/Write: tool_use gate asks a person before a write to CI, hook or bot config (GitLab, Jenkins, CircleCI, CODEOWNERS, husky, more). Not judged: deletions, empty writes, shell writes to non-GitHub CI paths; plugin installs ship no gate.

Chock adds friction. It is not a security boundary.

Its label on each agent

The catalog grades each policy on each agent. Pick an agent to build with this policy:

  • Claude Code TestedAsks Refuses a matched shell command before it runs. Asks on an agent's file writes and at turn endBuild →
  • Cursor TestedBlocks Refuses a matched shell command before it runs. Refuses an agent's file writes and refuses at turn end, because this client cannot prompt at either pointBuild →
  • Codex TestedBlocks Refuses a matched shell command before it runs. Refuses an agent's file writes and refuses at turn end, because this client cannot prompt at either point. If the hook errors, the action goes through (not witnessed; the vendor's row is only partly live-run)Build →
  • GitHub Copilot TestedBlocks Refuses a matched shell command before it runs. Refuses at turn end only, because this client cannot prompt there. It does not check a file write when it happens. If the hook errors, the action goes through (not witnessed; the vendor's row is only partly live-run)Build →
  • Devin TestedBlocks Refuses a matched shell command before it runs. Refuses at turn end only, because this client cannot prompt there. It does not check a file write when it happens. If the hook errors, the action goes through (vendor docs only, not witnessed)Build →
  • Grok Tested Not graded yet for GrokBuild →
  • goose Tested Not graded yet for gooseBuild →
  • Antigravity Tested Not graded yet for AntigravityBuild →
  • OpenHands Untested Not graded yet for OpenHandsBuild →
  • Kimi Code Untested Not graded yet for Kimi CodeBuild →
  • Factory Droid Untested Not graded yet for Factory DroidBuild →

See it in action

Refused

A request redirects new content over a workflow file.

echo "on: push" > .github/workflows/ci.yml

Allowed

A request reads a workflow file to inspect it.

cat .github/workflows/ci.yml

Both examples are this policy's own test cases.

What it misses

This policy does not state what it misses.

Latest change

0.2.7 · · Behaviour change, added coverage for equivalent spellings of the protected paths (SR-2d1; eval cases tc-056 to tc-063; tests in test_protect_ci_workflows_shell.py). The shell guard matches the folded path: // and /./ collapsed, .. resolved, trailing dots and spaces and stream suffixes dropped, case ignored. Relative paths are read from the directory a cd, pushd or popd before them left, and removing or moving the .github folder itself is refused. Shared shell reader updated (SR-2d1; the copy in implementations/chock_shellparse is regenerated, this policy's own script is unchanged). Added coverage: an arithmetic shift in $(( )), (( )) or $[ ] is no longer read as the start of a here-document, so the lines after it are judged as before; the string given to env -S or --split-string is read as the command env runs; env -i is recorded on the command it runs. Tests: test_shellparse_sr2d1.py.