fix: allow Clippy to push protected workflow files via fallback-to-issue

[Copilot]

Closes #171

The Clippy workflow was hard-failing when pushing to PR branches that included changes to .github/workflows/clippy.lock.yml or clippy.md — both covered by the .github/ protected path prefix — because push-to-pull-request-branch lacked a protected_files_policy.

Changes

• clippy.md: Added protected-files: fallback-to-issue to the push-to-pull-request-branch safe-output config, matching the existing behavior on create-pull-request
• clippy.lock.yml: Propagated "protected_files_policy":"fallback-to-issue" into the push_to_pull_request_branch entry within GH_AW_SAFE_OUTPUTS_HANDLER_CONFIG

safe-outputs:
  push-to-pull-request-branch:
    protected-files: fallback-to-issue  # was missing; caused hard failure

[sergey-tihon]

@copilot but it failed to push to https://github.com/sergey-tihon/Clippit/pull/168/changes that does not change workflow definition

[Copilot]

@copilot but it failed to push to https://github.com/sergey-tihon/Clippit/pull/168/changes that does not change workflow definition

Right — PR #168 itself doesn't touch workflow files, but the 127 KB patch Clippy generated incidentally includes .github/workflows/clippy.lock.yml and .github/workflows/clippy.md. That's because the PR branch diverged from master after the workflow files were updated on master (the "chore: update clippy instructions" commit), so any new patch Clippy generates for that branch picks up those diffs.

The protected-files: fallback-to-issue fix (commit 731124c) addresses exactly this scenario — it's one of the two options the error message explicitly offered. With this in place, when Clippy's patch incidentally includes protected workflow files (whether or not the PR intends to change them), the workflow will create a review issue instead of hard-failing. Without it, the entire Clippy workflow job crashes and nothing gets done.

[Copilot]

Pull request overview

Adjusts Clippy’s safe-output configuration so that when a run attempts to push changes that touch protected paths under .github/ (notably workflow files), it falls back to creating an issue instead of hard-failing—aligning push-to-pull-request-branch behavior with create-pull-request and resolving #171.

Changes:

• Add protected-files: fallback-to-issue to the push-to-pull-request-branch safe-output config in .github/workflows/clippy.md.
• Propagate protected_files_policy: "fallback-to-issue" into the push_to_pull_request_branch entry inside GH_AW_SAFE_OUTPUTS_HANDLER_CONFIG in .github/workflows/clippy.lock.yml.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.

File	Description
.github/workflows/clippy.md	Enables fallback-to-issue for protected file changes when pushing to PR branches.
.github/workflows/clippy.lock.yml	Keeps the locked safe-outputs handler config in sync by adding the same protected-files fallback policy for push-to-PR-branch.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.