[Bug] protected-files object form fails compilation despite being documented

[edgeq]

Summary

The protected-files field under create-pull-request safe-outputs is documented as supporting an object form with policy and exclude, but gh aw compile rejects it with a schema validation error.

Steps to reproduce

1. Add the following to a workflow's frontmatter:

safe-outputs:
  create-pull-request:
    title-prefix: "[docs] "
    protected-files:
      policy: fallback-to-issue
      exclude:
        - .claude/
        - .github/instructions/
    allowed-files:
      - README.md
      - CLAUDE.md

2. Run gh aw compile

Expected behavior

Compilation succeeds, with .claude/ and .github/instructions/ excluded from the protected set per the documented object-form syntax.

Actual behavior

.github/workflows/docs-sync.md:25:23: error: expected string or null, got object.
Expected format: {"footer":true,"preserve-branch-name":true,"reviewers":null}

The compiler only accepts string values (blocked, fallback-to-issue, allowed) or null for protected-files.

Documentation reference

The safe-outputs pull requests reference shows this as a valid configuration:

safe-outputs:
  create-pull-request:
    protected-files:
      policy: fallback-to-issue
      exclude:
        - AGENTS.md
        - .agents/

Use case

We have a documentation sync workflow that needs to update files under .claude/rules/ and .github/instructions/. Both paths fall under default protected path prefixes (.claude/ and .github/). Using protected-files: allowed is the current workaround, but it's broader than intended and often raises permission-denied errors — we'd prefer to exclude only the specific prefixes the agent needs to write to and not get denied permissions.

Environment

gh aw version

(CLI was updated via gh aw update on 2026-04-24)

[edgeq]

Update: confirmed fixed on v0.68.4+

Traced the fix to #26339 ("feat: add protected-files: { exclude: [...] } to override the default protected-file set"), merged 2026-04-15. That landed one day after v0.68.3 was cut, which is why a fresh install (pinned to GitHub's "latest release" marker) still reproduces the schema error reported here.

Repro → fix confirmed locally:

# Before: gh aw version v0.68.3 → object form rejected
gh extension remove aw
gh extension install github/gh-aw --pin v0.71.0
gh aw version   # v0.71.0
gh aw compile   # ✓ accepts the object form

Working config (same as the reference docs):

safe-outputs:
  create-pull-request:
    protected-files:
      policy: fallback-to-issue
      exclude:
        - .claude/
        - .github/instructions/

Leaving this issue open since the friction isn't really the code — it's that the gh extension install github/gh-aw default still hands users v0.68.3, which predates the fix. Users who follow the docs verbatim will hit this error until a release ≥ v0.68.4 is promoted to "latest" (everything v0.68.4 → v0.71.0 is currently marked prerelease: true). A couple of options worth considering:

1. Promote a recent tag to stable so the default install picks up the fix.
2. Mention the prerelease pin path (gh extension install github/gh-aw --pin vX.Y.Z) in the setup / troubleshooting docs for users who need features newer than the stable marker.

Happy to close this once either lands, or whenever the "latest release" flag catches up.