Add .fips-template.yaml to opt into fips-agents patch flow#21
Merged
Conversation
Without this manifest, fips-agents-cli refuses to run `fips-agents patch` against sandbox projects — the CLI's hardcoded fallback has no built-in category set for the 'sandbox' project type, so it now emits a friendly ✗ error pointing here (see fips-agents/fips-agents-cli#50). The presence of this file is what makes the patch flow work for projects scaffolded from this template. Schema: schema_version: 1, three categories (chart, docs, build) and a 10-entry never_patch list separating template-managed scaffolding from the user's runtime, tests, deploy values, and repo settings. Conservative defaults — sandbox/** (the runtime) and tests/** are in never_patch on the agent-template precedent: users may have customized these and we don't silently overwrite them. If we later decide users should track upstream runtime changes via patch, that's a follow-up that adds a 'runtime' category covering sandbox/**/*.py with ask_before_patch: true. Companion to fips-agents/fips-agents-cli#48 (the loader, shipped in v0.12.0). Older CLI installs ignore the file — non-breaking. Assisted-by: Claude Code (Opus 4.7)
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Net-new file at the repo root — does not touch anything PR #20 is changing, so safe to land independently.
What
Adds `.fips-template.yaml` (`schema_version: 1`) declaring how `fips-agents patch` should treat this template. Three categories:
Plus a 10-entry `never_patch` list:
Why
Without this file, scaffolded sandbox projects today get a clean ✗ error from `fips-agents patch check` (post fips-agents/fips-agents-cli#50, shipped in v0.12.1) telling them sandbox isn't patchable until the template ships a manifest. After this PR merges and a sandbox project is re-scaffolded (or an existing one runs `patch check` against the new template), the patch flow works for chart / docs / build drift.
Conservative defaults — sandbox runtime is NEVER_PATCH
`sandbox/**/*.py` is in `never_patch` on the agent-template precedent: users may have customized the executor, guardrails, or seccomp wiring, and we don't silently overwrite their changes. If we later decide users SHOULD track upstream runtime changes via patch, that's a follow-up adding a `runtime` category with `ask_before_patch: true`.
Compatibility
Test plan