From 0a8d86c0c1ac5653f647cfa87986a991d1b62f1c Mon Sep 17 00:00:00 2001
From: "github-actions[bot]"
 <41898282+github-actions[bot]@users.noreply.github.com>
Date: Sat, 5 Sep 2026 21:05:06 +0000
Subject: [PATCH] Fix: status-report archetype omits min-integrity: none
 despite its own tip

The status-report archetype's tips list explicitly instructs setting
tools.github.min-integrity: none (since status reports only summarize
untrusted issue/PR/discussion content, never act on it), but the
archetype definition in patterns/workflow-generation.json had no
min_integrity field, so generateWorkflowFile never emitted the line
in the suggested starter YAML shown to the downstream agent.

Downstream agents anchor heavily on the concrete starter YAML in the
prompt over prose guidance buried in a bullet list, so the omission
meant many generated status-report workflows likely dropped this
safety setting despite the tip.

Fix: add "min_integrity": "none" to the status-report archetype so
the generated frontmatter matches its own documented guidance.

Also updated the outdated test that asserted status-report never gets
min-integrity, and added a replacement test using documentation-updater
(an archetype without github toolsets) to keep coverage for archetypes
that legitimately omit min-integrity.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
---
 patterns/workflow-generation.json |  3 ++-
 test/workflow.test.js             | 14 +++++++++++++-
 2 files changed, 15 insertions(+), 2 deletions(-)

diff --git a/patterns/workflow-generation.json b/patterns/workflow-generation.json
index bb5827f..b41e239 100644
--- a/patterns/workflow-generation.json
+++ b/patterns/workflow-generation.json
@@ -369,7 +369,8 @@
         "- Stick to facts. Do not editorialize or make recommendations.",
         "- If there is no activity, create a brief report noting that.",
         "- Label the report issue with `status-report`."
-      ]
+      ],
+      "min_integrity": "none"
     },
     "dependency-monitor": {
       "icon": "package",
diff --git a/test/workflow.test.js b/test/workflow.test.js
index b043a84..58ed889 100644
--- a/test/workflow.test.js
+++ b/test/workflow.test.js
@@ -310,7 +310,7 @@ describe('generateWorkflowFile', () => {
     expect(md).toContain('  github:\n    toolsets: [repos, issues, pull_requests]\n    min-integrity: approved\n');
   });
 
-  it('does not add min-integrity for archetypes without untrusted external content', () => {
+  it('sets min-integrity: none for status-report, which reads untrusted content but only summarizes', () => {
     const md = generateWorkflowFile(
       answers({
         archetype: 'status-report',
@@ -319,6 +319,18 @@ describe('generateWorkflowFile', () => {
       }),
       patterns
     );
+    expect(md).toContain('    min-integrity: none\n');
+  });
+
+  it('does not add min-integrity for archetypes without github toolsets', () => {
+    const md = generateWorkflowFile(
+      answers({
+        archetype: 'documentation-updater',
+        triggers: ['push'],
+        outputs: ['create-pull-request']
+      }),
+      patterns
+    );
     expect(md).not.toContain('min-integrity');
   });