Enforce workflow allowlist during composition

[adampoit]

Summary

• require allowedWorkflows in version-1 Patchlane configuration
• have patchlane init populate the detected CI filename, with an explicit override available
• implicitly include Patchlane-generated sync-upstream.yml and promote-tested-sync.yml workflows
• enforce the composed workflow policy in doctor, dry-run/publishing syncs, and exact-SHA promotion
• report unexpected, missing, and dangling/disallowed reusable workflows without mutating published refs
• consolidate migration notes in docs/migrations.md with vNext and versioned sections
• direct migration-capable skills to fetch the current guide from the raw GitHub URL

The package version remains unchanged; the planned 0.5.0 version bump will be handled separately with the other fixes for that release.

Testing

• npm test
• npm run format:check
• npm run artifacts:check
• Patchlane fork setup skill validator

Closes #48

[not-adam]

Mira PR Walkthrough

This PR introduces a mandatory allowedWorkflows field in the version-1 Patchlane config and enforces a workflow allowlist policy across sync, promotion, and doctor operations. A new workflow-policy.ts module validates that the composed workflow tree matches the allowlist, implicitly including Patchlane-generated workflows (sync-upstream.yml, promote-tested-sync.yml). The patchlane init command auto-populates the allowlist from the detected CI workflow filename, and comprehensive tests and migration documentation are included.

graph LR
    config["src/config.ts"]
    policy["src/workflow-policy.ts"]
    sync["src/integration-sync.ts"]
    promote["src/promote-sync.ts"]
    doctor["src/doctor.ts"]
    init["src/init.ts"]

    config --> policy
    sync --> policy
    promote --> policy
    doctor --> policy
    init --> config

Loading

Confidence: 4/5   ◉◉◉◉○   Safe with minor fixes

• The implementation is thorough with strong validation, backward-compatible handling when allowedWorkflows is undefined, and comprehensive test coverage. The migration guide is well-documented. Minor consideration: the enforcement could fail for users who haven't yet added allowedWorkflows to their config.

Blast Radius — 2 dependent repositories, 3 total references

adampoit/mira — 1 reference
adampoit/wezterm — 2 references

21 files reviewed

---

Comment @not-adam help to get the list of available commands and usage tips.

[adampoit]

@not-adam review