--- id: protect-ci-workflows track: coding version: 0.2.7 label: asks keyword: ask where: command write turn-end sha256: 9cdd0aba07068856569b04b202de8f6e1b5b46bff400e682e916a5a2a02bfac9 source: https://github.com/open-coder-ai/chock-catalog/tree/1e60d211c1bb767152c6ab0167932da06ab3a10f/base/protect-ci-workflows catalog_ref: 1e60d211c1bb767152c6ab0167932da06ab3a10f --- # Protect CI Workflows protect-ci-workflows · version 0.2.7 Asks — Refuses a matched shell command before it runs. Asks on an agent's file writes and at turn end. Chock adds friction. It is not a security boundary. In a git repo: in agent (The agent's hooks check this once chock sync sets them up. If the hook crashes, the action goes through.) ## What it does Asks a person before an agent weakens the checks that review its work. Shell guard refuses writes to .github/workflows/, .github/actions/, .github/dependabot.y*ml (redirect, rm/mv/tee/sed -i, cp into, git checkout/restore, cmdlets); reads and \`chock sync\` pass. Edit/Write: tool_use gate asks a person before a write to CI, hook or bot config (GitLab, Jenkins, CircleCI, CODEOWNERS, husky, more). Not judged: deletions, empty writes, shell writes to non-GitHub CI paths; plugin installs ship no gate. ## Its label on each agent - Claude Code (tested): Asks — Refuses a matched shell command before it runs. Asks on an agent's file writes and at turn end. Builder: /coding/builder/#client=claude-code&p=protect-ci-workflows - Cursor (tested): Blocks — Refuses a matched shell command before it runs. Refuses an agent's file writes and refuses at turn end, because this client cannot prompt at either point. Builder: /coding/builder/#client=cursor&p=protect-ci-workflows - Codex (tested): Blocks — Refuses a matched shell command before it runs. Refuses an agent's file writes and refuses at turn end, because this client cannot prompt at either point. If the hook errors, the action goes through (not witnessed; the vendor's row is only partly live-run). Builder: /coding/builder/#client=codex&p=protect-ci-workflows - GitHub Copilot (tested): Blocks — Refuses a matched shell command before it runs. Refuses at turn end only, because this client cannot prompt there. It does not check a file write when it happens. If the hook errors, the action goes through (not witnessed; the vendor's row is only partly live-run). Builder: /coding/builder/#client=copilot&p=protect-ci-workflows - Devin (tested): Blocks — Refuses a matched shell command before it runs. Refuses at turn end only, because this client cannot prompt there. It does not check a file write when it happens. If the hook errors, the action goes through (vendor docs only, not witnessed). Builder: /coding/builder/#client=devin&p=protect-ci-workflows - Grok (tested): Not graded yet for Grok. Builder: /coding/builder/#client=grok&p=protect-ci-workflows - goose (tested): Not graded yet for goose. Builder: /coding/builder/#client=goose&p=protect-ci-workflows - Antigravity (tested): Not graded yet for Antigravity. Builder: /coding/builder/#client=antigravity&p=protect-ci-workflows - OpenHands (untested): Not graded yet for OpenHands. Builder: /coding/builder/#client=openhands&p=protect-ci-workflows - Kimi Code (untested): Not graded yet for Kimi Code. Builder: /coding/builder/#client=kimi-code&p=protect-ci-workflows - Factory Droid (untested): Not graded yet for Factory Droid. Builder: /coding/builder/#client=factory-droid&p=protect-ci-workflows ## What it misses This policy does not state what it misses. ## Examples - Refused: A request redirects new content over a workflow file. — `echo "on: push" > .github/workflows/ci.yml` - Allowed: A request reads a workflow file to inspect it. — `cat .github/workflows/ci.yml` ## Latest change 0.2.7 · 2026-10-24 — Behaviour change, added coverage for equivalent spellings of the protected paths (SR-2d1; eval cases tc-056 to tc-063; tests in test_protect_ci_workflows_shell.py). The shell guard matches the folded path: \`//\` and \`/./\` collapsed, \`..\` resolved, trailing dots and spaces and stream suffixes dropped, case ignored. Relative paths are read from the directory a \`cd\`, \`pushd\` or \`popd\` before them left, and removing or moving the \`.github\` folder itself is refused. Shared shell reader updated (SR-2d1; the copy in implementations/chock_shellparse is regenerated, this policy's own script is unchanged). Added coverage: an arithmetic shift in \`$(( ))\`, \`(( ))\` or \`$\[ \]\` is no longer read as the start of a here-document, so the lines after it are judged as before; the string given to \`env -S\` or \`--split-string\` is read as the command env runs; \`env -i\` is recorded on the command it runs. Tests: test_shellparse_sr2d1.py. ## Provenance - Tested by 63 of 63 cases run automatically - SHA-256: `9cdd0aba07068856569b04b202de8f6e1b5b46bff400e682e916a5a2a02bfac9` - Catalog commit: https://github.com/open-coder-ai/chock-catalog/commit/1e60d211c1bb767152c6ab0167932da06ab3a10f - Source: https://github.com/open-coder-ai/chock-catalog/tree/1e60d211c1bb767152c6ab0167932da06ab3a10f/base/protect-ci-workflows (catalog path `base/protect-ci-workflows`) - Presets: CI pipeline - JSON: `/api/coding/policies/protect-ci-workflows.json` - Report a problem: https://chock.sh/report/?policy=protect-ci-workflows&version=0.2.7&page=%2Fcoding%2Fpolicies%2Fprotect-ci-workflows%2F