Repository navigation
Protect CHANGELOG.md in dependency worker compiled contract #2091
Description
Problem
The canonical dependency-worker workflow does not currently guarantee that CHANGELOG.md remains protected all the way through gh-aw compilation. A prompt- or source-text-only assertion would not prove the emitted lock artifact enforces the contract.
Acceptance criteria
-
CHANGELOG.mdis protected in the canonical dependency-worker workflow source. - Strict gh-aw compilation succeeds and the emitted compiled lock workflow contains the
CHANGELOG.mdprotected-file contract. - Regression tests inspect the compiled lock output, not only prompt or configuration text.
- A realistic mutation of the live canonical source that removes
CHANGELOG.mdprotection causes the regression test to fail. - Targeted tests and the required repository build pass.
Scope
Keep this change narrowly focused on the dependency worker compiled protected-file contract. Do not couple it to #2074 or #2069.
Activity
github-actions commentedon Sep 28, 2026
📋 Assigned to agentic-workflows-dev (Agentic Workflows Engineer)
Issue: #2091 — Protect CHANGELOG.md in dependency worker compiled contract
agentic-workflows-dev will pick this up in the next Copilot session.
Merge origin/dev into dependency changelog protection
fix(gh-aw): protect dependency changelog
chore(release): promote dev to main (v1.1.0) (#2241)