Enable strict mode for all agentic workflows

[Copilot]

Overview

This PR enables strict mode validation for all 15 agentic workflows in .github/workflows/, ensuring enhanced security and reliability constraints are enforced for production workflows.

What is Strict Mode?

Strict mode is a validation feature that enforces additional security and operational requirements on agentic workflows:

1. Timeout Required - Prevents runaway executions through mandatory timeout_minutes
2. Write Permissions Blocked - Refuses direct write permissions (use safe-outputs instead)
3. Network Configuration Required - Must explicitly configure network access
4. No Network Wildcards - Cannot use wildcard * in allowed domains
5. MCP Network Configuration - Custom MCP servers with containers must have network config

Changes Made

Added strict: true to All Workflows

All 15 workflows now have strict: true in their frontmatter:

• artifacts-summary.md
• brave.md (already had it)
• changeset-generator.md
• ci-doctor.md
• cli-version-checker.md
• dev.md
• duplicate-code-detector.md
• go-pattern-detector.md
• issue-classifier.md
• notion-issue-summary.md
• pdf-summary.md
• poem-bot.md
• scout.md
• technical-doc-writer.md
• tidy.md

Fixed Strict Mode Violations

1. dev.md

# Added missing timeout
timeout_minutes: 10
strict: true

2. notion-issue-summary.md

# Added missing timeout
timeout_minutes: 10
strict: true

3. duplicate-code-detector.md

# Added network configuration for serena MCP server
mcp-servers:
  serena:
    container: "ghcr.io/oraios/serena"
    network:
      allowed:
        - "github.com"

Verification

• ✅ All 15 workflows compile successfully with --strict flag
• ✅ Zero compilation errors
• ✅ All unit and integration tests pass
• ✅ No regressions introduced

Benefits

• Cost Control: Mandatory timeouts prevent unbounded execution costs
• Security: Minimizes attack surface by blocking write permissions and requiring explicit network access
• Compliance: Ensures workflows meet organizational security standards
• Auditability: Clear security requirements make workflows easier to review

All workflows continue to function as before while now enforcing stricter validation rules for enhanced security and reliability.

Original prompt

make all agentic workflows under .github/workflows "strict: true". Fix issues in agentic workflows or in the compiler.

---

💬 Share your feedback on Copilot coding agent for the chance to win a $200 gift card! Click here to start the survey.