Skip to main content
rulesSource-backed

Generated Artifact Churn Rules for Registry Repositories

Source-backed rules for registry repositories that must keep contributor PRs focused on source files while generated indexes, feeds, downloads, search data, README output, and previews are rebuilt by trusted automation.

by MkDev11·added 2026-06-04·
Review first review before installing

Open the source and read safety notes before installing.

Citation facts

Source-backed facts for citing this resource, derived directly from the registry — also available as plain text for AI assistants.

Source URLs
https://git-scm.com/docs/gitattributes, https://github.com/JSONbored/awesome-claude/blob/main/content/rules/generated-artifact-churn-rules.mdx
Safety notes
Generated artifacts can hide unrelated rewrites, stale data, broken provenance, checksum drift, or accidental inclusion of private metadata., Do not trust a generated diff unless the reviewed source input, generator version, and command or workflow are known., Block PRs that mix raw content changes with broad generated output churn unless repository policy explicitly requires contributor-generated artifacts.
Privacy notes
Generated registry artifacts can copy private source paths, timestamps, account names, API responses, prompt excerpts, logs, screenshots, package metadata, or reviewer notes into public files., Review generated output for accidental disclosure before publishing downloads, search indexes, README sections, feeds, or previews., Prefer synthetic examples and public metadata in source entries so downstream generated files do not amplify private context.
Author
MkDev11
Submitted by
MkDev11
Claim status
unclaimed
Last verified
2026-06-04

Decision playbook

Review trust signals before you adopt

Signals are present but mixed. Use the checklist below to confirm the source and operational safety for your environment.

Compare context
Selected

0

Current score

63

Baseline

Delta

No baseline selected

No major trust-signal divergence detected in the current selection.

Source and provenance checks

Needs review

Confirm ownership and provenance before trusting install instructions.

  • Source link availableRequired

    Open the canonical repository and verify ownership.

    Done
  • Source provenance statusRequired

    Marked as source-backed.

    Done
  • Metadata reviewed

    No reviewed flag detected in metadata.

    Pending

Safety and privacy checks

Complete

Validate risk disclosures before installation or API wiring.

  • Safety notes presentRequired

    Review the listed safety guidance before running commands.

    Done
  • Privacy notes presentRequired

    Review data handling notes before connecting accounts or secrets.

    Done
  • Trust level risk gateRequired

    Trust level does not block evaluation.

    Done

Package and install checks

Needs review

Check package metadata and artifact integrity signals.

  • Install payload available

    Install or copy payload is available for review.

    Done
  • Package verification flag

    No package verification flag provided.

    Pending
  • Checksum metadata

    No checksum provided for downloaded artifact.

    Pending

Compare-driven decision checks

Needs review

Use compare context to validate trade-offs before adoption.

  • Compare tray has multiple entries

    Add at least one more entry to compare trust differences.

    Pending
  • Baseline comparison available

    No baseline peer selected yet.

    Pending
  • Diverging trust signals identified

    No major trust-signal divergence found.

    Pending

Setup at a glance

Copy & paste

Copy-ready — paste the snippet to get started.

10 minutes

Adoption plan

Balanced adoption plan

Current risk score 24/100. Use staged verification before broader rollout.

Risk 24

Pre-adoption checks

Validate source and review signals before any execution.

  • Confirm source provenanceRequired

    Source URL/provenance metadata is present.

    Done
  • Confirm metadata review state

    No review metadata found; increase manual validation.

    Pending
  • Verify install payload

    Install/config payload exists and can be inspected.

    Done

Security checks

Confirm safety, privacy, and package integrity signals.

  • Review safety notesRequired

    Safety notes are present.

    Done
  • Review privacy notesRequired

    Privacy notes are present.

    Done
  • Verify package integrity metadata

    No package verification/checksum metadata.

    Pending

Rollout

Adopt in controlled steps based on the selected plan.

  • Run in isolated sandbox firstRequired

    Use a constrained sandbox and observe behavior across multiple tasks.

    Pending
  • Roll out graduallyRequired

    Roll out to a small cohort before wider usage.

    Pending
  • Set monitoring and fallback

    Define rollback path and monitor errors after adoption.

    Pending

Evidence readiness

Evidence readiness matrix · balanced

Missing required evidence: Metadata review. Risk score 31.

Risk 31

Source provenance

Present

Source repository/provenance is listed.

Required in this preset

Metadata review

Missing

Review metadata is missing.

Required in this preset

Safety notes

Present

Safety notes are present.

Required in this preset

Privacy notes

Present

Privacy notes are present.

Optional in this preset

Package integrity

Missing

Package integrity metadata is missing.

Optional in this preset

Install payload

Present

Install payload is available.

Required in this preset

Required gaps: Metadata review

Decision timeline

Decision timeline · balanced

Blocking gaps: Check metadata review status. Risk 28.

Risk 28

triage

Confirm source provenanceRequired

Source/provenance metadata is available.

Done

triage

Check metadata review statusRequired

Review metadata is missing.

Pending

verify

Review safety notesRequired

Safety notes are available.

Done

verify

Review privacy notes

Privacy notes are available.

Done

verify

Validate package integrity metadata

Package integrity metadata is missing.

Pending

rollout

Verify install payload and commandsRequired

Install payload is available.

Done

Blockers: Check metadata review status

Prerequisite readiness

Prerequisite readiness

4 prerequisites to line up before setup. Includes a review or approval gate.

0/4 ready
Permissions & scopes1Review & approval2General110 minutes

Safety & privacy surface

Safety & privacy surface

3 safety and 3 privacy notes across 4 risk areas. Review closely: network access.

4 areas
  • SafetyGeneralGenerated artifacts can hide unrelated rewrites, stale data, broken provenance, checksum drift, or accidental inclusion of private metadata.
  • SafetyExecution & processesDo not trust a generated diff unless the reviewed source input, generator version, and command or workflow are known.
  • SafetyGeneralBlock PRs that mix raw content changes with broad generated output churn unless repository policy explicitly requires contributor-generated artifacts.
  • PrivacyLocal filesGenerated registry artifacts can copy private source paths, timestamps, account names, API responses, prompt excerpts, logs, screenshots, package metadata, or reviewer notes into public files.
  • PrivacyNetwork accessReview generated output for accidental disclosure before publishing downloads, search indexes, README sections, feeds, or previews.
  • PrivacyLocal filesPrefer synthetic examples and public metadata in source entries so downstream generated files do not amplify private context.

Safety notes

  • Generated artifacts can hide unrelated rewrites, stale data, broken provenance, checksum drift, or accidental inclusion of private metadata.
  • Do not trust a generated diff unless the reviewed source input, generator version, and command or workflow are known.
  • Block PRs that mix raw content changes with broad generated output churn unless repository policy explicitly requires contributor-generated artifacts.

Privacy notes

  • Generated registry artifacts can copy private source paths, timestamps, account names, API responses, prompt excerpts, logs, screenshots, package metadata, or reviewer notes into public files.
  • Review generated output for accidental disclosure before publishing downloads, search indexes, README sections, feeds, or previews.
  • Prefer synthetic examples and public metadata in source entries so downstream generated files do not amplify private context.

Prerequisites

  • A registry repository with raw source entries and derived artifacts such as feeds, indexes, README sections, previews, search data, downloads, or public JSON.
  • A documented generation command, build job, or maintainer workflow that can reproduce generated outputs from source.
  • A file-classification convention such as `.gitattributes`, comments, path naming, or review labels for generated files.
  • Permission to request a source-only resubmission when generated artifact churn hides the actual content change.

Schema details

Install type
copy
Reading time
6 min
Difficulty score
37
Troubleshooting
Yes
Breaking changes
No
Collection metadata
Estimated setup
10 minutes
Difficulty
beginner
Full copyable content
You are reviewing generated artifact churn in a registry repository.

Rules:
1. Contributor PRs should change the raw source entry, not generated indexes,
   feeds, downloads, README output, or previews.
2. Generated artifacts need a reviewed source input, a deterministic command,
   and a trusted automation path.
3. Mark generated files so reviewers can distinguish source intent from build
   output noise.
4. Block merge when generated output changes without the source file or
   generator change that explains it.
5. Rebuild artifacts after merge in maintainer automation unless the project
   explicitly asks contributors to include them.

About this resource

Purpose

Use these rules when reviewing a registry repository where raw source entries produce many derived files. Examples include public data feeds, category indexes, search manifests, README sections, Raycast or plugin exports, package bundles, generated previews, and static-site data.

Generated artifacts are useful, but they are a poor place to review contributor intent. The source entry should explain what changed. Generated output should be reproducible from that source and rebuilt by the trusted path the project expects.

Artifact Classification

Classify a changed file before reviewing content.

  1. Source file. The human-authored entry, config, rules, guide, command, or source document that reviewers should inspect for intent.
  2. Generator code. The script, package, workflow, or template that turns source files into derived artifacts.
  3. Generated artifact. A file rebuilt from source or generator code, such as indexes, feeds, bundles, generated docs, snapshots, registry JSON, or README sections.
  4. Build cache or transient output. Local output that should not be committed unless the repository explicitly tracks it.

When the category is unclear, ask the contributor or maintainer to identify the source of truth before approving the diff.

Source-Only Rules

  • Contributor content PRs should add or update exactly the raw source files the issue asks for.
  • Generated artifacts should stay out of contributor PRs unless the repository explicitly requires them.
  • A generated file change without a source input change is a merge blocker until the generator or source explanation is found.
  • A source file change that causes massive generated churn should be reviewed as a source change first, then rebuilt in maintainer automation.
  • Do not accept "I ran the build" as enough evidence when the repository policy says generated output is maintainer-owned.

Generated File Marking

Generated files should be easy for reviewers and platforms to recognize.

  • Use .gitattributes or repository conventions to mark generated paths when appropriate.
  • Keep generated paths predictable, such as public/data/**, dist/**, generated/**, snapshots/**, or repository-specific output directories.
  • Add a short generated-file header only when the file format and project policy support it.
  • Keep source and generated files in separate paths so reviewers can filter noisy output.
  • Update file classification when a generated path becomes hand-authored source or vice versa.

Reproducibility Rules

Generated artifacts are reviewable only when their provenance is clear.

  • Name the command, workflow, or build job that regenerates the artifact.
  • Record the source input path or generator code path that explains the output.
  • Avoid machine-local timestamps, absolute paths, random ordering, host-specific metadata, and environment-dependent output when possible.
  • Pin or document generator versions when output format matters.
  • If generation is intentionally non-deterministic, keep it out of routine contributor PRs and let maintainers publish it through a controlled path.

Reviewer Rules

  • Review raw source first, generated output second.
  • Compare generated artifact changes against the source input that produced them.
  • Ask for a source-only resubmission when generated churn hides a small content change.
  • Treat generator or workflow changes as code changes, not content-only submissions.
  • Confirm that generated artifacts do not include private metadata, local paths, credentials, timestamps, or stale source URLs.
  • Do not merge broad generated rewrites to fix unrelated lint, formatting, ordering, or timestamp changes in a content PR.

Do Not Merge When

  • the PR includes README output, registry feeds, search data, package bundles, previews, or generated JSON when the issue asks for one source file;
  • generated artifacts changed but the source entry, generator code, or command is missing;
  • generated output includes local paths, private identifiers, secret-like values, prompt excerpts, internal reviewer notes, or stale source metadata;
  • the generated diff is mostly timestamp, ordering, formatting, or checksum churn that reviewers cannot reproduce;
  • the contributor changed generator code and content in one PR without explicit maintainer approval;
  • a closed one-shot submission is retried by force-pushing generated fixes instead of opening a clean source-only PR.

Review Checklist

  • {"task": "Source changed", "description": "The PR changes the raw source entry or source input requested by the issue"}
  • {"task": "Generated output excluded", "description": "Generated feeds, indexes, README output, previews, bundles, and snapshots are absent unless project policy requires them"}
  • {"task": "Generator known", "description": "Any generated artifact has a named command, workflow, or generator path"}
  • {"task": "Diff is reproducible", "description": "Generated output avoids unexplained timestamps, random ordering, local paths, and environment-specific metadata"}
  • {"task": "Files are classified", "description": "Generated paths are marked or conventionally separated so reviewers can filter churn"}
  • {"task": "Privacy checked", "description": "Generated files do not expose secrets, private paths, prompts, logs, account IDs, or reviewer notes"}

Troubleshooting

  • The project requires generated files: include the generation command, source input, generator version, and a note that repository policy requires the artifacts.
  • The generated diff is huge: split source changes from generator changes, then let maintainers rebuild artifacts in a separate automation run.
  • The source entry looks correct but generated data is stale: merge the source-only PR only if project policy says generated data is rebuilt after merge.
  • The artifact order changes every run: stabilize sorting or keep the output out of contributor PRs until the generator is deterministic.
  • A generated file contains private data: stop normal review, remove the value at the source, rebuild, and check secondary artifacts before publishing.

Marking Generated Artifacts in .gitattributes

Tell Git how to treat generated paths so reviewers see less churn. The binary macro is defined as [attr]binary -diff -merge -text, so it unsets diff, merge, and text in one attribute.

# Suppress diffs for a generated path (still tracked, just no textual diff)
*.ps -diff

# Treat a generated bundle as binary (unsets diff, merge, and text)
*.ps binary

# Built-in binary macro definition (for reference)
[attr]binary -diff -merge -text
Attribute on a path State Effect per gitattributes docs
diff Unset (-diff) "will generate Binary files differ (or a binary patch, if binary patches are enabled)"
diff Unspecified "gets its contents inspected, and if it looks like text ... it is treated as text. Otherwise it would generate Binary files differ"
merge Unset (-merge) "Take the version from the current branch as the tentative merge result, and declare that the merge has conflicts"
binary (macro) Set "Setting the "binary" attribute also unsets the "text" and "diff" attributes as above"

Duplicate Check

Checked existing rules, guides, collections, hooks, skills, commands, registry quality code, submission gate code, open PRs, and closed PR history for generated artifact churn, source-only PRs, generated file review, registry artifact policy, large generated diffs, README refresh output, and source-backed content submissions.

Adjacent content includes a source-backed content PR guide, documentation freshness rules, generated-diff hooks, and submission gate code that enforces single-source-file shape. This rules entry is distinct because it gives portable do/don't behavior for reviewers and contributors deciding when generated artifact churn should block or be moved to maintainer automation.

References

Source citations

Add this badge to your README

Show that Generated Artifact Churn Rules for Registry Repositories is listed on HeyClaude. Paste this Markdown into your README — it renders the badge and links back to this page.

Listed on HeyClaude
[![Listed on HeyClaude](https://heyclau.de/badge/rules/generated-artifact-churn-rules.svg)](https://heyclau.de/entry/rules/generated-artifact-churn-rules)

How it compares

Generated Artifact Churn Rules for Registry Repositories side by side with 3 alternatives on trust, install, platform support, and disclosed safety notes — all from reviewed registry metadata.

Field

Source-backed rules for registry repositories that must keep contributor PRs focused on source files while generated indexes, feeds, downloads, search data, README output, and previews are rebuilt by trusted automation.

Open dossier

Source-backed rules for AI coding assistants that must avoid exposing, copying, logging, committing, or normalizing secrets while editing code, configs, tests, prompts, documentation, and CI workflows.

Open dossier

Source-backed rules for preparing direct content-only pull requests with one raw MDX file, reachable provenance URLs, issue closure, duplicate history, validation evidence, and no generated artifact churn.

Open dossier

Source-backed rules for reviewing dependency update pull requests with supply-chain context, lockfile discipline, advisory checks, compatibility evidence, and privacy-safe metadata handling.

Open dossier
Next steps
Trust
Review statusNot reviewedNot reviewedNot reviewedNot reviewed
Package trustPackage not verifiedPackage not verifiedPackage not verifiedPackage not verified
Source provenanceSource-backedSource-backedSource-backedSource-backed
SubmitterMkDev11MkDev11MkDev11MkDev11
Install riskReview firstReview firstReview firstReview first
Notes Safety ✓ Privacy ✓ Safety ✓ Privacy ✓ Safety ✓ Privacy ✓ Safety ✓ Privacy ✓
Brand
Categoryrulesrulesrulesrules
SourceSource-backedSource-backedSource-backedSource-backed
AuthorMkDev11MkDev11MkDev11MkDev11
Added2026-06-042026-06-042026-06-042026-06-04
Platforms
Harness
Source repo
Safety notesGenerated artifacts can hide unrelated rewrites, stale data, broken provenance, checksum drift, or accidental inclusion of private metadata. Do not trust a generated diff unless the reviewed source input, generator version, and command or workflow are known. Block PRs that mix raw content changes with broad generated output churn unless repository policy explicitly requires contributor-generated artifacts.Treat any discovered credential as compromised until an owner confirms it is fake, expired, or rotated. Do not ask the assistant to test live production credentials, print secrets for debugging, or copy token values into issue comments, PR bodies, generated docs, fixtures, or screenshots. Block merge when generated artifacts, logs, snapshots, notebooks, lockfiles, or config examples include real-looking secrets or private identifiers.These rules do not run content or automate submissions; they are a review gate for keeping direct content PRs focused and verifiable. Do not run generators, package builds, download packaging, README refreshes, or maintainer automation while preparing a content-only PR unless the issue explicitly requires it. If the submitted entry describes hooks, MCP servers, shell commands, installers, credentialed tools, external writes, or destructive actions, require specific safety notes for that entry before opening the PR.Dependency updates can change runtime code, install scripts, build plugins, transitive packages, lockfile integrity hashes, generated clients, and deployment behavior. Security updates should be prioritized, but they still need compatibility evidence, a rollback path, and review of newly introduced transitive dependencies. Treat major version upgrades, package-manager changes, new registries, git dependencies, postinstall scripts, and build-tool updates as high-risk until reviewed.
Privacy notesGenerated registry artifacts can copy private source paths, timestamps, account names, API responses, prompt excerpts, logs, screenshots, package metadata, or reviewer notes into public files. Review generated output for accidental disclosure before publishing downloads, search indexes, README sections, feeds, or previews. Prefer synthetic examples and public metadata in source entries so downstream generated files do not amplify private context.Secrets often appear next to private account IDs, customer names, repository paths, internal hostnames, prompt text, and incident context; redact surrounding context, not only the token. A model transcript, debug log, trace, or review comment can become a secondary copy of a secret even when the code diff is later cleaned. Use synthetic examples such as `EXAMPLE_API_KEY` and document the secret name or storage location without revealing the value.PR bodies, source URLs, issue links, duplicate-search notes, screenshots, and validation logs are public review artifacts. Do not use private repositories, customer names, internal docs, local paths, account identifiers, tokens, screenshots with secrets, or unpublished data as public source evidence. When validation output or duplicate evidence contains private details, summarize the verification class publicly and keep sensitive evidence in the approved private channel.Dependency names, versions, private registry hosts, scoped package names, repository URLs, and advisory matches can reveal proprietary architecture or unreleased product plans. Do not paste full private lockfiles, internal package metadata, paid registry URLs, or vulnerability details into public PR comments. External advisory and package-health services should only receive public package identifiers, or private identifiers after explicit approval.
Prerequisites
  • A registry repository with raw source entries and derived artifacts such as feeds, indexes, README sections, previews, search data, downloads, or public JSON.
  • A documented generation command, build job, or maintainer workflow that can reproduce generated outputs from source.
  • A file-classification convention such as `.gitattributes`, comments, path naming, or review labels for generated files.
  • Permission to request a source-only resubmission when generated artifact churn hides the actual content change.
  • A repository, task, or assistant session that may touch credentials, environment variables, CI secrets, API tokens, private keys, webhook secrets, cookies, sessions, or private identifiers.
  • A known project policy for secret storage, such as environment variables, CI secret stores, local credential helpers, or an approved vault.
  • Permission to stop work, redact content, or request rotation if a real secret is found.
  • Access to a scanner, review checklist, or manual inspection process before committing assistant-generated files.
  • A selected content slot issue, target category, proposed title, and proposed slug before creating the branch.
  • Public source URLs that load successfully and directly support the entry's claims.
  • A duplicate-search pass across existing content, live PRs, closed PRs, source domains, docs URLs, package URLs, provider names, and aliases.
  • A local checkout where category validation, content policy validation, and whitespace checks can run before the branch is pushed.
  • A dependency update pull request with manifest, lockfile, and package-manager context.
  • Access to current CI, test results, dependency review output, advisory alerts, and release notes or changelogs for the updated packages.
  • A project policy for supported runtimes, package managers, registries, license constraints, and emergency security updates.
  • Permission to split, defer, or block dependency updates when provenance, compatibility, or privacy evidence is incomplete.
Install
Config
Citations
ClaimUnclaimedUnclaimedUnclaimedUnclaimed
Open 4 picks in the interactive comparison tool

Signals

Loading live community signals…

More like this, weekly

A short, calm digest of reviewed Claude resources. Unsubscribe any time.