Protocol
Give workflow changes their own approval gate
A workflow file can turn a code diff into privileged execution.
When it fits
- An agent edits CI/CD configuration as part of another task.
When to avoid it
- Exact controls depend on CI platform; apply the same principle to any pipeline with credentials or deployment authority.
Why it matters
Flag workflow, deployment and release configuration changes separately. Require review by the appropriate owner before workflows receive secrets, elevated tokens or deployment capability. Do not let a passing application test suite auto-approve a new execution pipeline.
Steps
- Workflow diff highlighted.
- Permissions reviewed.
- Secret use reviewed.
- Third-party actions reviewed.
- Trigger conditions reviewed.
- Owner explicitly approves.
An example
A PR that changes a GitHub Actions permission from read to write cannot merge under the normal application-code review alone.
Check your result
Privileged automation changes have a visible approval distinct from feature correctness.
Keep this limit in mind
- Exact controls depend on CI platform; apply the same principle to any pipeline with credentials or deployment authority.
Evidence and sources
OWASP treats rules files, build scripts, CI workflows and package lifecycle scripts as security-sensitive control surfaces that deserve heightened review when an agent changes them.
The exact sensitive-file set depends on the repository and build system.
Secure Coding with AI Cheat Sheet · Rules Files; Prompt-to-Code Supply Chain Risk
GitHub documentation says Copilot agent pull requests should receive the same thorough review as other contributions and warns reviewers to inspect workflow changes before allowing privileged Actions runs.
This is GitHub-specific implementation guidance; the general pattern is independent review before privileged execution.
Review output from Copilot · Review Copilot's changes; Manage GitHub Actions workflow runs