[bradygaster]

Summary

• protect CHANGELOG.md in the canonical dependency-worker safe-output contract
• keep the packaged workflow source and manifest digest synchronized
• assert against the emitted compiled lock configuration
• add a live-source mutation regression proving removal of the protection turns the compiled-contract guard red

Closes #2091

Validation

• gh aw compile squad-deps-worker --strict --no-check-update in an isolated repository-shaped fixture
• emitted squad-deps-worker.lock.yml contains CHANGELOG.md in create_pull_request.excluded_files
• npx vitest run test/gh-aw-deps-worker-workflow.test.ts — 20/20 passed
• realistic mutation removes CHANGELOG.md from the canonical source, still compiles, and causes the compiled regression assertion to fail
• npm run gh-aw:integrity:check
• npm run build

gh-aw safe-update review

Strict compilation reported the dependency worker's existing restricted secret/action references as unapproved in the isolated fixture:

• SQUAD_GITHUB_APP_PRIVATE_KEY
• SQUAD_GITHUB_TOKEN
• bradygaster/squad/.github/actions/squad-init

These references are pre-existing in the canonical dependency-worker workflow and are unchanged by this PR. The change only adds CHANGELOG.md to create_pull_request.excluded_files; it introduces no new secret, action, redirect, permission, or network access.

[github-actions]

🛫 PR Readiness Check

ℹ️ This comment updates on each push. Last checked: commit f6f481f

PR Scope: 🔧 Infrastructure

⚠️ 2 item(s) to address before review

Status	Check	Details
❌	Single commit	2 commits — consider squashing before review
✅	Not in draft	Ready for review
✅	Branch up to date	Up to date with dev
❌	Copilot review	No Copilot review yet — it may still be processing
✅	Changeset present	No source files changed — changeset not required
✅	Scope clean	No .squad/ or docs/proposals/ files
✅	No merge conflicts	No merge conflicts
✅	Copilot threads resolved	No Copilot review threads
✅	CI passing	All checks passing

Files Changed (4 files, +70 −8)

File	+/−
test/gh-aw-deps-worker-workflow.test.ts	+65 −7
workflows/package/squad-deps-worker.md	+1 −0
workflows/squad-deps-worker.md	+3 −0
workflows/squad-workflows.manifest.json	+1 −1

Total: +70 −8

---

This check runs automatically on every push. Fix any ❌ items and push again.
See CONTRIBUTING.md and PR Requirements for details.

[github-actions]

🟡 Impact Analysis — PR #2092

Risk tier: 🟡 MEDIUM

📊 Summary

Metric	Count
Files changed	4
Files added	0
Files modified	4
Files deleted	0
Modules touched	2

🎯 Risk Factors

• 4 files changed (≤5 → LOW)
• 2 modules touched (2-4 → MEDIUM)

📦 Modules Affected

root (3 files)

• workflows/package/squad-deps-worker.md
• workflows/squad-deps-worker.md
• workflows/squad-workflows.manifest.json

tests (1 file)

• test/gh-aw-deps-worker-workflow.test.ts

---

This report is generated automatically for every PR. See #733 for details.

[Copilot]

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.

Note

This error may be related to your runner configuration. You can now configure runners for Copilot code review separately from Copilot cloud agent by creating a copilot-code-review.yml file with your setup steps. Read the docs for details.