Generated Artifact Churn Rules for Registry Repositories
Source-backed rules for registry repositories that must keep contributor PRs focused on source files while generated indexes, feeds, downloads, search data, README output, and previews are rebuilt by trusted automation.
Generated artifacts can hide unrelated rewrites, stale data, broken provenance, checksum drift, or accidental inclusion of private metadata., Do not trust a generated diff unless the reviewed source input, generator version, and command or workflow are known., Block PRs that mix raw content changes with broad generated output churn unless repository policy explicitly requires contributor-generated artifacts.
Privacy notes
Generated registry artifacts can copy private source paths, timestamps, account names, API responses, prompt excerpts, logs, screenshots, package metadata, or reviewer notes into public files., Review generated output for accidental disclosure before publishing downloads, search indexes, README sections, feeds, or previews., Prefer synthetic examples and public metadata in source entries so downstream generated files do not amplify private context.
Author
MkDev11
Submitted by
MkDev11
Claim status
unclaimed
Last verified
2026-06-04
Decision playbook
Review trust signals before you adopt
Signals are present but mixed. Use the checklist below to confirm the source and operational safety for your environment.
Compare context
Selected
0
Current score
63
Baseline
—
Delta
No baseline selected
No major trust-signal divergence detected in the current selection.
Source and provenance checks
Needs review
Confirm ownership and provenance before trusting install instructions.
Source link availableRequired
Open the canonical repository and verify ownership.
Done
Source provenance statusRequired
Marked as source-backed.
Done
Metadata reviewed
No reviewed flag detected in metadata.
Pending
Safety and privacy checks
Complete
Validate risk disclosures before installation or API wiring.
Safety notes presentRequired
Review the listed safety guidance before running commands.
Done
Privacy notes presentRequired
Review data handling notes before connecting accounts or secrets.
Done
Trust level risk gateRequired
Trust level does not block evaluation.
Done
Package and install checks
Needs review
Check package metadata and artifact integrity signals.
Install payload available
Install or copy payload is available for review.
Done
Package verification flag
No package verification flag provided.
Pending
Checksum metadata
No checksum provided for downloaded artifact.
Pending
Compare-driven decision checks
Needs review
Use compare context to validate trade-offs before adoption.
Compare tray has multiple entries
Add at least one more entry to compare trust differences.
3 safety and 3 privacy notes across 4 risk areas. Review closely: network access.
4 areas
SafetyGeneralGenerated artifacts can hide unrelated rewrites, stale data, broken provenance, checksum drift, or accidental inclusion of private metadata.
SafetyExecution & processesDo not trust a generated diff unless the reviewed source input, generator version, and command or workflow are known.
SafetyGeneralBlock PRs that mix raw content changes with broad generated output churn unless repository policy explicitly requires contributor-generated artifacts.
PrivacyLocal filesGenerated registry artifacts can copy private source paths, timestamps, account names, API responses, prompt excerpts, logs, screenshots, package metadata, or reviewer notes into public files.
PrivacyNetwork accessReview generated output for accidental disclosure before publishing downloads, search indexes, README sections, feeds, or previews.
PrivacyLocal filesPrefer synthetic examples and public metadata in source entries so downstream generated files do not amplify private context.
Safety notes
Generated artifacts can hide unrelated rewrites, stale data, broken provenance, checksum drift, or accidental inclusion of private metadata.
Do not trust a generated diff unless the reviewed source input, generator version, and command or workflow are known.
Block PRs that mix raw content changes with broad generated output churn unless repository policy explicitly requires contributor-generated artifacts.
Privacy notes
Generated registry artifacts can copy private source paths, timestamps, account names, API responses, prompt excerpts, logs, screenshots, package metadata, or reviewer notes into public files.
Review generated output for accidental disclosure before publishing downloads, search indexes, README sections, feeds, or previews.
Prefer synthetic examples and public metadata in source entries so downstream generated files do not amplify private context.
Prerequisites
A registry repository with raw source entries and derived artifacts such as feeds, indexes, README sections, previews, search data, downloads, or public JSON.
A documented generation command, build job, or maintainer workflow that can reproduce generated outputs from source.
A file-classification convention such as `.gitattributes`, comments, path naming, or review labels for generated files.
Permission to request a source-only resubmission when generated artifact churn hides the actual content change.
Schema details
Install type
copy
Reading time
6 min
Difficulty score
37
Troubleshooting
Yes
Breaking changes
No
Collection metadata
Estimated setup
10 minutes
Difficulty
beginner
Full copyable content
You are reviewing generated artifact churn in a registry repository.
Rules:
1. Contributor PRs should change the raw source entry, not generated indexes,
feeds, downloads, README output, or previews.
2. Generated artifacts need a reviewed source input, a deterministic command,
and a trusted automation path.
3. Mark generated files so reviewers can distinguish source intent from build
output noise.
4. Block merge when generated output changes without the source file or
generator change that explains it.
5. Rebuild artifacts after merge in maintainer automation unless the project
explicitly asks contributors to include them.
About this resource
Purpose
Use these rules when reviewing a registry repository where raw source entries
produce many derived files. Examples include public data feeds, category
indexes, search manifests, README sections, Raycast or plugin exports, package
bundles, generated previews, and static-site data.
Generated artifacts are useful, but they are a poor place to review contributor
intent. The source entry should explain what changed. Generated output should be
reproducible from that source and rebuilt by the trusted path the project
expects.
Artifact Classification
Classify a changed file before reviewing content.
Source file. The human-authored entry, config, rules, guide, command, or
source document that reviewers should inspect for intent.
Generator code. The script, package, workflow, or template that turns
source files into derived artifacts.
Generated artifact. A file rebuilt from source or generator code, such as
indexes, feeds, bundles, generated docs, snapshots, registry JSON, or README
sections.
Build cache or transient output. Local output that should not be
committed unless the repository explicitly tracks it.
When the category is unclear, ask the contributor or maintainer to identify the
source of truth before approving the diff.
Source-Only Rules
Contributor content PRs should add or update exactly the raw source files the
issue asks for.
Generated artifacts should stay out of contributor PRs unless the repository
explicitly requires them.
A generated file change without a source input change is a merge blocker until
the generator or source explanation is found.
A source file change that causes massive generated churn should be reviewed as
a source change first, then rebuilt in maintainer automation.
Do not accept "I ran the build" as enough evidence when the repository policy
says generated output is maintainer-owned.
Generated File Marking
Generated files should be easy for reviewers and platforms to recognize.
Use .gitattributes or repository conventions to mark generated paths when
appropriate.
Keep generated paths predictable, such as public/data/**, dist/**,
generated/**, snapshots/**, or repository-specific output directories.
Add a short generated-file header only when the file format and project policy
support it.
Keep source and generated files in separate paths so reviewers can filter
noisy output.
Update file classification when a generated path becomes hand-authored source
or vice versa.
Reproducibility Rules
Generated artifacts are reviewable only when their provenance is clear.
Name the command, workflow, or build job that regenerates the artifact.
Record the source input path or generator code path that explains the output.
Avoid machine-local timestamps, absolute paths, random ordering, host-specific
metadata, and environment-dependent output when possible.
Pin or document generator versions when output format matters.
If generation is intentionally non-deterministic, keep it out of routine
contributor PRs and let maintainers publish it through a controlled path.
Reviewer Rules
Review raw source first, generated output second.
Compare generated artifact changes against the source input that produced
them.
Ask for a source-only resubmission when generated churn hides a small content
change.
Treat generator or workflow changes as code changes, not content-only
submissions.
Confirm that generated artifacts do not include private metadata, local paths,
credentials, timestamps, or stale source URLs.
Do not merge broad generated rewrites to fix unrelated lint, formatting,
ordering, or timestamp changes in a content PR.
Do Not Merge When
the PR includes README output, registry feeds, search data, package bundles,
previews, or generated JSON when the issue asks for one source file;
generated artifacts changed but the source entry, generator code, or command
is missing;
generated output includes local paths, private identifiers, secret-like
values, prompt excerpts, internal reviewer notes, or stale source metadata;
the generated diff is mostly timestamp, ordering, formatting, or checksum
churn that reviewers cannot reproduce;
the contributor changed generator code and content in one PR without explicit
maintainer approval;
a closed one-shot submission is retried by force-pushing generated fixes
instead of opening a clean source-only PR.
Review Checklist
{"task": "Source changed", "description": "The PR changes the raw source entry or source input requested by the issue"}
{"task": "Generator known", "description": "Any generated artifact has a named command, workflow, or generator path"}
{"task": "Diff is reproducible", "description": "Generated output avoids unexplained timestamps, random ordering, local paths, and environment-specific metadata"}
{"task": "Files are classified", "description": "Generated paths are marked or conventionally separated so reviewers can filter churn"}
{"task": "Privacy checked", "description": "Generated files do not expose secrets, private paths, prompts, logs, account IDs, or reviewer notes"}
Troubleshooting
The project requires generated files: include the generation command,
source input, generator version, and a note that repository policy requires
the artifacts.
The generated diff is huge: split source changes from generator changes,
then let maintainers rebuild artifacts in a separate automation run.
The source entry looks correct but generated data is stale: merge the
source-only PR only if project policy says generated data is rebuilt after
merge.
The artifact order changes every run: stabilize sorting or keep the output
out of contributor PRs until the generator is deterministic.
A generated file contains private data: stop normal review, remove the
value at the source, rebuild, and check secondary artifacts before publishing.
Marking Generated Artifacts in .gitattributes
Tell Git how to treat generated paths so reviewers see less churn. The binary macro is defined as [attr]binary -diff -merge -text, so it unsets diff, merge, and text in one attribute.
# Suppress diffs for a generated path (still tracked, just no textual diff)
*.ps -diff
# Treat a generated bundle as binary (unsets diff, merge, and text)
*.ps binary
# Built-in binary macro definition (for reference)
[attr]binary -diff -merge -text
Attribute on a path
State
Effect per gitattributes docs
diff
Unset (-diff)
"will generate Binaryfilesdiffer (or a binary patch, if binary patches are enabled)"
diff
Unspecified
"gets its contents inspected, and if it looks like text ... it is treated as text. Otherwise it would generate Binaryfilesdiffer"
merge
Unset (-merge)
"Take the version from the current branch as the tentative merge result, and declare that the merge has conflicts"
binary (macro)
Set
"Setting the "binary" attribute also unsets the "text" and "diff" attributes as above"
Duplicate Check
Checked existing rules, guides, collections, hooks, skills, commands, registry
quality code, submission gate code, open PRs, and closed PR history for
generated artifact churn, source-only PRs, generated file review, registry
artifact policy, large generated diffs, README refresh output, and source-backed
content submissions.
Adjacent content includes a source-backed content PR guide, documentation
freshness rules, generated-diff hooks, and submission gate code that enforces
single-source-file shape. This rules entry is distinct because it gives portable
do/don't behavior for reviewers and contributors deciding when generated
artifact churn should block or be moved to maintainer automation.
Show that Generated Artifact Churn Rules for Registry Repositories is listed on HeyClaude. Paste this Markdown into your README — it renders the badge and links back to this page.
[](https://heyclau.de/entry/rules/generated-artifact-churn-rules)
How it compares
Generated Artifact Churn Rules for Registry Repositories side by side with 3 alternatives on trust, install, platform support, and disclosed safety notes — all from reviewed registry metadata.
Source-backed rules for registry repositories that must keep contributor PRs focused on source files while generated indexes, feeds, downloads, search data, README output, and previews are rebuilt by trusted automation.
Source-backed rules for AI coding assistants that must avoid exposing, copying, logging, committing, or normalizing secrets while editing code, configs, tests, prompts, documentation, and CI workflows.
Source-backed rules for preparing direct content-only pull requests with one raw MDX file, reachable provenance URLs, issue closure, duplicate history, validation evidence, and no generated artifact churn.
✓Generated artifacts can hide unrelated rewrites, stale data, broken provenance, checksum drift, or accidental inclusion of private metadata.
Do not trust a generated diff unless the reviewed source input, generator version, and command or workflow are known.
Block PRs that mix raw content changes with broad generated output churn unless repository policy explicitly requires contributor-generated artifacts.
✓Treat any discovered credential as compromised until an owner confirms it is fake, expired, or rotated.
Do not ask the assistant to test live production credentials, print secrets for debugging, or copy token values into issue comments, PR bodies, generated docs, fixtures, or screenshots.
Block merge when generated artifacts, logs, snapshots, notebooks, lockfiles, or config examples include real-looking secrets or private identifiers.
✓These rules do not run content or automate submissions; they are a review gate for keeping direct content PRs focused and verifiable.
Do not run generators, package builds, download packaging, README refreshes, or maintainer automation while preparing a content-only PR unless the issue explicitly requires it.
If the submitted entry describes hooks, MCP servers, shell commands, installers, credentialed tools, external writes, or destructive actions, require specific safety notes for that entry before opening the PR.
✓Dependency updates can change runtime code, install scripts, build plugins, transitive packages, lockfile integrity hashes, generated clients, and deployment behavior.
Security updates should be prioritized, but they still need compatibility evidence, a rollback path, and review of newly introduced transitive dependencies.
Treat major version upgrades, package-manager changes, new registries, git dependencies, postinstall scripts, and build-tool updates as high-risk until reviewed.
Privacy notes
✓Generated registry artifacts can copy private source paths, timestamps, account names, API responses, prompt excerpts, logs, screenshots, package metadata, or reviewer notes into public files.
Review generated output for accidental disclosure before publishing downloads, search indexes, README sections, feeds, or previews.
Prefer synthetic examples and public metadata in source entries so downstream generated files do not amplify private context.
✓Secrets often appear next to private account IDs, customer names, repository paths, internal hostnames, prompt text, and incident context; redact surrounding context, not only the token.
A model transcript, debug log, trace, or review comment can become a secondary copy of a secret even when the code diff is later cleaned.
Use synthetic examples such as `EXAMPLE_API_KEY` and document the secret name or storage location without revealing the value.
✓PR bodies, source URLs, issue links, duplicate-search notes, screenshots, and validation logs are public review artifacts.
Do not use private repositories, customer names, internal docs, local paths, account identifiers, tokens, screenshots with secrets, or unpublished data as public source evidence.
When validation output or duplicate evidence contains private details, summarize the verification class publicly and keep sensitive evidence in the approved private channel.
✓Dependency names, versions, private registry hosts, scoped package names, repository URLs, and advisory matches can reveal proprietary architecture or unreleased product plans.
Do not paste full private lockfiles, internal package metadata, paid registry URLs, or vulnerability details into public PR comments.
External advisory and package-health services should only receive public package identifiers, or private identifiers after explicit approval.
Prerequisites
A registry repository with raw source entries and derived artifacts such as feeds, indexes, README sections, previews, search data, downloads, or public JSON.
A documented generation command, build job, or maintainer workflow that can reproduce generated outputs from source.
A file-classification convention such as `.gitattributes`, comments, path naming, or review labels for generated files.
Permission to request a source-only resubmission when generated artifact churn hides the actual content change.
A repository, task, or assistant session that may touch credentials, environment variables, CI secrets, API tokens, private keys, webhook secrets, cookies, sessions, or private identifiers.
A known project policy for secret storage, such as environment variables, CI secret stores, local credential helpers, or an approved vault.
Permission to stop work, redact content, or request rotation if a real secret is found.
Access to a scanner, review checklist, or manual inspection process before committing assistant-generated files.
A selected content slot issue, target category, proposed title, and proposed slug before creating the branch.
Public source URLs that load successfully and directly support the entry's claims.
A duplicate-search pass across existing content, live PRs, closed PRs, source domains, docs URLs, package URLs, provider names, and aliases.
A local checkout where category validation, content policy validation, and whitespace checks can run before the branch is pushed.
A dependency update pull request with manifest, lockfile, and package-manager context.
Access to current CI, test results, dependency review output, advisory alerts, and release notes or changelogs for the updated packages.
A project policy for supported runtimes, package managers, registries, license constraints, and emergency security updates.
Permission to split, defer, or block dependency updates when provenance, compatibility, or privacy evidence is incomplete.