From 59d0faaf1266a03ccddc2809332cfa9c95393f78 Mon Sep 17 00:00:00 2001
From: Patrick Honkonen <1883101+SaintPatrck@users.noreply.github.com>
Date: Fri, 28 Aug 2026 16:23:13 +0000
Subject: [PATCH] llm: Exclude claude-code-action's restored config paths from
 the SDK-update push guard (#7321)

---
 .github/workflows/sdlc-sdk-update-evaluate.yml | 12 ++++++++++--
 1 file changed, 10 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/sdlc-sdk-update-evaluate.yml b/.github/workflows/sdlc-sdk-update-evaluate.yml
index a47da7d72e..35a4c34955 100644
--- a/.github/workflows/sdlc-sdk-update-evaluate.yml
+++ b/.github/workflows/sdlc-sdk-update-evaluate.yml
@@ -168,9 +168,17 @@ jobs:
         env:
           _BRANCH_NAME: ${{ github.event.pull_request.head.ref }}
         run: |
-          if [ -n "$(git status --porcelain)" ]; then
+          # claude-code-action treats the PR head as untrusted and restores these exact paths from
+          # origin/main before running Claude, regardless of whether this branch's copy is stale.
+          # This job never has a legitimate reason to change them, so a diff here is that restore,
+          # not Claude — exclude them rather than flag it.
+          _TRUSTED_CONFIG_PATHSPEC=(
+            ':!.claude' ':!.mcp.json' ':!.claude.json' ':!.gitmodules' ':!.ripgreprc'
+            ':!CLAUDE.md' ':!CLAUDE.local.md' ':!.husky'
+          )
+          if [ -n "$(git status --porcelain -- . "${_TRUSTED_CONFIG_PATHSPEC[@]}")" ]; then
             echo "::error::Claude left uncommitted changes; nothing was pushed."
-            git status --porcelain
+            git status --porcelain -- . "${_TRUSTED_CONFIG_PATHSPEC[@]}"
             exit 1
           fi