[PR] fix(ci): exclude the vetted-ops policy from the sandbox-write-denied hooks [magpie]

["potiuk (via GitHub)" <gi...@apache.org>]

potiuk opened a new pull request, #1309:
URL: https://github.com/apache/magpie/pull/1309

   ## Summary
   
   - Follow-up to #1308. That PR added a `permissions.deny` rule on `.apache-magpie-overrides/tools/vetted-ops/**` but did not extend the `sandbox_write_denied` exclude in `.pre-commit-config.yaml` that exists for exactly this case.
   - A `permissions.deny` rule becomes a sandbox filesystem write-deny, so `end-of-file-fixer`, `mixed-line-ending` and `trailing-whitespace` abort `prek run --all-files` inside an agent session with `Operation not permitted` — even though the file needs no fix.
   - Adds the path to the exclude, and states the coupling in the comment, since it is easy to miss: a new `permissions.deny` rule on an in-repo path needs that path added here too.
   
   ## Type of change
   
   - [x] CI / dev loop (`prek`, workflows, validators)
   
   ## Test plan
   
   - [x] `prek run --all-files` exits 0 **inside the agent sandbox with no bypass**, which is the property the exclude block exists to preserve. Before this change it aborted with:
   
   ```
   error: Failed to run hook `end-of-file-fixer`
     caused by: failed to open file `.apache-magpie-overrides/tools/vetted-ops/config.toml`: Operation not permitted (os error 1)
   ```
   
   ## RFC-AI-0004 compliance
   
   - [x] **Sandbox** — no change to the deny rules themselves; only the hooks' file filter
   
   ## Linked issues
   
   Refs #1308
   
   ## Notes for reviewers
   
   The vetted-ops policy loses no coverage by skipping EOF / whitespace / line-ending normalisation: `vetted_ops.config` parses it on every dispatch, so a malformed file fails the call.
   
   Dropping `Write(...)` and keeping `Edit(...)` is **not** an alternative fix — `Edit(.claude/settings.json)` has no companion `Write` rule and still produces the sandbox write-deny, which is why `.claude/settings.json` was already in this exclude.
   
   🤖 Generated with [Claude Code](https://claude.com/claude-code)
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@magpie.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] fix(ci): exclude the vetted-ops policy from the sandbox-write-denied hooks [magpie]

["potiuk (via GitHub)" <gi...@apache.org>]

potiuk merged PR #1309:
URL: https://github.com/apache/magpie/pull/1309


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@magpie.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org