Allow agentic-wiki-writer Step 2c PRs for .github/agentic-wiki/** protected-path writes

[Copilot]

agentic-wiki-writer can generate .github/agentic-wiki/PAGES.md on first run, but Step 2c PR creation was blocked because .github/ is protected by default. This caused create-pull-request to fail and downstream safe outputs (including wiki push) to be canceled.

• Safe-output policy update (create-pull-request)

  • Scoped PR file writes to the template directory only:
    • allowed-files: [".github/agentic-wiki/**"]
  • Explicitly permitted protected-path writes for this output:
    • protected-files: allowed

• Effect on workflow behavior

  • Step 2c can open the initial template PR for .github/agentic-wiki/PAGES.md instead of being rejected by default protected path-prefix policy.
  • The write scope remains tightly constrained to .github/agentic-wiki/**.

safe-outputs:
  create-pull-request:
    title-prefix: "[agentic-wiki]"
    labels: [documentation, automated]
    allowed-files:
      - ".github/agentic-wiki/**"
    protected-files: allowed

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

• https://api.github.com/repos/actions/download-artifact/git/ref/tags/v8
  • Triggering command: /usr/bin/gh gh api /repos/actions/download-artifact/git/ref/tags/v8 --jq .object.sha (http block)
• https://api.github.com/repos/github/gh-aw-actions/git/ref/tags/v0.66.1
  • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw-actions/git/ref/tags/v0.66.1 --jq .object.sha (http block)
• https://api.github.com/repos/githubnext/agentics
  • Triggering command: /usr/bin/gh gh api /repos/githubnext/agentics --jq .visibility (http block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)