Add create-pr-allowed-files input to workflows using create-pull-request safe output

.github/workflows/gh-aw-create-pr-from-issue.md

@@ -57,6 +57,11 @@ on:
         type: boolean
         required: false
         default: true
+      create-pr-allowed-files:
+        description: "Glob pattern restricting which files the agent may modify in the PR (e.g. `src/**`); leave empty to rely on the default protected-files policy only"
+        type: string
+        required: false
+        default: ""
       report-failure-as-issue:
         description: "When true, agent failures are reported as GitHub issues"
         type: boolean

.github/workflows/gh-aw-fragments/safe-output-create-pr.md

@@ -125,6 +125,8 @@ safe-outputs:
   create-pull-request:
     patch-format: bundle
     draft: ${{ inputs.draft-prs }}
+    allowed-files:
+      - ${{ inputs.create-pr-allowed-files }}
     github-token-for-extra-empty-commit: ${{ secrets.EXTRA_COMMIT_GITHUB_TOKEN }}
 ---
 
@@ -139,3 +141,4 @@ Before calling `create_pull_request`, call `ready_to_make_pr` and apply its chec
 - **Committed changes required**: You must have locally committed changes before creating a PR.
 - **Base branch**: The PR targets the repository's default branch.
 - **Max per run**: Typically 1 PR creation per workflow run.
+- **Allowed files**: When `create-pr-allowed-files` is set, only files matching the specified glob pattern can be modified. When unset, the default gh-aw behavior applies: only the `protected-files` policy restricts changes, and all other files are permitted.

.github/workflows/gh-aw-issue-fixer.md

@@ -52,6 +52,11 @@ on:
         type: boolean
         required: false
         default: true
+      create-pr-allowed-files:
+        description: "Glob pattern restricting which files the agent may modify in the PR (e.g. `src/**`); leave empty to rely on the default protected-files policy only"
+        type: string
+        required: false
+        default: ""
       report-failure-as-issue:
         description: "When true, agent failures are reported as GitHub issues"
         type: boolean

.github/workflows/gh-aw-mention-in-issue-by-id.md

@@ -57,6 +57,11 @@ on:
         type: boolean
         required: false
         default: true
+      create-pr-allowed-files:
+        description: "Glob pattern restricting which files the agent may modify in the PR (e.g. `src/**`); leave empty to rely on the default protected-files policy only"
+        type: string
+        required: false
+        default: ""
       report-failure-as-issue:
         description: "When true, agent failures are reported as GitHub issues"
         type: boolean

.github/workflows/gh-aw-mention-in-issue-no-sandbox.md

@@ -54,6 +54,11 @@ on:
         type: boolean
         required: false
         default: true
+      create-pr-allowed-files:
+        description: "Glob pattern restricting which files the agent may modify in the PR (e.g. `src/**`); leave empty to rely on the default protected-files policy only"
+        type: string
+        required: false
+        default: ""
       report-failure-as-issue:
         description: "When true, agent failures are reported as GitHub issues"
         type: boolean

.github/workflows/gh-aw-mention-in-issue.md

@@ -54,6 +54,11 @@ on:
         type: boolean
         required: false
         default: true
+      create-pr-allowed-files:
+        description: "Glob pattern restricting which files the agent may modify in the PR (e.g. `src/**`); leave empty to rely on the default protected-files policy only"
+        type: string
+        required: false
+        default: ""
       report-failure-as-issue:
         description: "When true, agent failures are reported as GitHub issues"
         type: boolean

.github/workflows/gh-aw-release-update.md

@@ -47,6 +47,11 @@ on:
         type: boolean
         required: false
         default: true
+      create-pr-allowed-files:
+        description: "Glob pattern restricting which files the agent may modify in the PR (e.g. `src/**`); leave empty to rely on the default protected-files policy only"
+        type: string
+        required: false
+        default: ""
       report-failure-as-issue:
         description: "When true, agent failures are reported as GitHub issues"
         type: boolean