Skip to main content
rulesSource-backedReview first Safety Privacy

Generated Artifact Churn Rules for Registry Repositories

Source-backed rules for registry repositories that must keep contributor PRs focused on source files while generated indexes, feeds, downloads, search data, README output, and previews are rebuilt by trusted automation.

by MkDev11·added 2026-06-04·
Claude Code
HarnessClaude Code
Review first review before installing

Open the source and read safety notes before installing.

Safety notes

  • Generated artifacts can hide unrelated rewrites, stale data, broken provenance, checksum drift, or accidental inclusion of private metadata.
  • Do not trust a generated diff unless the reviewed source input, generator version, and command or workflow are known.
  • Block PRs that mix raw content changes with broad generated output churn unless repository policy explicitly requires contributor-generated artifacts.

Privacy notes

  • Generated registry artifacts can copy private source paths, timestamps, account names, API responses, prompt excerpts, logs, screenshots, package metadata, or reviewer notes into public files.
  • Review generated output for accidental disclosure before publishing downloads, search indexes, README sections, feeds, or previews.
  • Prefer synthetic examples and public metadata in source entries so downstream generated files do not amplify private context.

Prerequisites

  • A registry repository with raw source entries and derived artifacts such as feeds, indexes, README sections, previews, search data, downloads, or public JSON.
  • A documented generation command, build job, or maintainer workflow that can reproduce generated outputs from source.
  • A file-classification convention such as `.gitattributes`, comments, path naming, or review labels for generated files.
  • Permission to request a source-only resubmission when generated artifact churn hides the actual content change.

Schema details

Install type
copy
Reading time
6 min
Difficulty score
37
Troubleshooting
Yes
Breaking changes
No
Collection metadata
Estimated setup
10 minutes
Difficulty
beginner
Full copyable content
## Purpose

Use these rules when reviewing a registry repository where raw source entries
produce many derived files. Examples include public data feeds, category
indexes, search manifests, README sections, Raycast or plugin exports, package
bundles, generated previews, and static-site data.

Generated artifacts are useful, but they are a poor place to review contributor
intent. The source entry should explain what changed. Generated output should be
reproducible from that source and rebuilt by the trusted path the project
expects.

## Artifact Classification

Classify a changed file before reviewing content.

1. **Source file.** The human-authored entry, config, rules, guide, command, or
   source document that reviewers should inspect for intent.
2. **Generator code.** The script, package, workflow, or template that turns
   source files into derived artifacts.
3. **Generated artifact.** A file rebuilt from source or generator code, such as
   indexes, feeds, bundles, generated docs, snapshots, registry JSON, or README
   sections.
4. **Build cache or transient output.** Local output that should not be
   committed unless the repository explicitly tracks it.

When the category is unclear, ask the contributor or maintainer to identify the
source of truth before approving the diff.

## Source-Only Rules

- Contributor content PRs should add or update exactly the raw source files the
  issue asks for.
- Generated artifacts should stay out of contributor PRs unless the repository
  explicitly requires them.
- A generated file change without a source input change is a merge blocker until
  the generator or source explanation is found.
- A source file change that causes massive generated churn should be reviewed as
  a source change first, then rebuilt in maintainer automation.
- Do not accept "I ran the build" as enough evidence when the repository policy
  says generated output is maintainer-owned.

## Generated File Marking

Generated files should be easy for reviewers and platforms to recognize.

- Use `.gitattributes` or repository conventions to mark generated paths when
  appropriate.
- Keep generated paths predictable, such as `public/data/**`, `dist/**`,
  `generated/**`, `snapshots/**`, or repository-specific output directories.
- Add a short generated-file header only when the file format and project policy
  support it.
- Keep source and generated files in separate paths so reviewers can filter
  noisy output.
- Update file classification when a generated path becomes hand-authored source
  or vice versa.

## Reproducibility Rules

Generated artifacts are reviewable only when their provenance is clear.

- Name the command, workflow, or build job that regenerates the artifact.
- Record the source input path or generator code path that explains the output.
- Avoid machine-local timestamps, absolute paths, random ordering, host-specific
  metadata, and environment-dependent output when possible.
- Pin or document generator versions when output format matters.
- If generation is intentionally non-deterministic, keep it out of routine
  contributor PRs and let maintainers publish it through a controlled path.

## Reviewer Rules

- Review raw source first, generated output second.
- Compare generated artifact changes against the source input that produced
  them.
- Ask for a source-only resubmission when generated churn hides a small content
  change.
- Treat generator or workflow changes as code changes, not content-only
  submissions.
- Confirm that generated artifacts do not include private metadata, local paths,
  credentials, timestamps, or stale source URLs.
- Do not merge broad generated rewrites to fix unrelated lint, formatting,
  ordering, or timestamp changes in a content PR.

## Do Not Merge When

- the PR includes README output, registry feeds, search data, package bundles,
  previews, or generated JSON when the issue asks for one source file;
- generated artifacts changed but the source entry, generator code, or command
  is missing;
- generated output includes local paths, private identifiers, secret-like
  values, prompt excerpts, internal reviewer notes, or stale source metadata;
- the generated diff is mostly timestamp, ordering, formatting, or checksum
  churn that reviewers cannot reproduce;
- the contributor changed generator code and content in one PR without explicit
  maintainer approval;
- a closed one-shot submission is retried by force-pushing generated fixes
  instead of opening a clean source-only PR.

## Review Checklist

- [ ] {"task": "Source changed", "description": "The PR changes the raw source entry or source input requested by the issue"}
- [ ] {"task": "Generated output excluded", "description": "Generated feeds, indexes, README output, previews, bundles, and snapshots are absent unless project policy requires them"}
- [ ] {"task": "Generator known", "description": "Any generated artifact has a named command, workflow, or generator path"}
- [ ] {"task": "Diff is reproducible", "description": "Generated output avoids unexplained timestamps, random ordering, local paths, and environment-specific metadata"}
- [ ] {"task": "Files are classified", "description": "Generated paths are marked or conventionally separated so reviewers can filter churn"}
- [ ] {"task": "Privacy checked", "description": "Generated files do not expose secrets, private paths, prompts, logs, account IDs, or reviewer notes"}

## Troubleshooting

- **The project requires generated files:** include the generation command,
  source input, generator version, and a note that repository policy requires
  the artifacts.
- **The generated diff is huge:** split source changes from generator changes,
  then let maintainers rebuild artifacts in a separate automation run.
- **The source entry looks correct but generated data is stale:** merge the
  source-only PR only if project policy says generated data is rebuilt after
  merge.
- **The artifact order changes every run:** stabilize sorting or keep the output
  out of contributor PRs until the generator is deterministic.
- **A generated file contains private data:** stop normal review, remove the
  value at the source, rebuild, and check secondary artifacts before publishing.

## Duplicate Check

Checked existing rules, guides, collections, hooks, skills, commands, registry
quality code, submission gate code, open PRs, and closed PR history for
generated artifact churn, source-only PRs, generated file review, registry
artifact policy, large generated diffs, README refresh output, and source-backed
content submissions.

Adjacent content includes a source-backed content PR guide, documentation
freshness rules, generated-diff hooks, and submission gate code that enforces
single-source-file shape. This rules entry is distinct because it gives portable
do/don't behavior for reviewers and contributors deciding when generated
artifact churn should block or be moved to maintainer automation.

## References

- Git gitattributes documentation: https://git-scm.com/docs/gitattributes
- GitHub Linguist overrides: https://github.com/github-linguist/linguist/blob/main/docs/overrides.md
- GitHub changed-file display customization: https://docs.github.com/en/repositories/working-with-files/managing-files/customizing-how-changed-files-appear-on-github
- Reproducible Builds definition: https://reproducible-builds.org/docs/definition/

About this resource

Purpose

Use these rules when reviewing a registry repository where raw source entries produce many derived files. Examples include public data feeds, category indexes, search manifests, README sections, Raycast or plugin exports, package bundles, generated previews, and static-site data.

Generated artifacts are useful, but they are a poor place to review contributor intent. The source entry should explain what changed. Generated output should be reproducible from that source and rebuilt by the trusted path the project expects.

Artifact Classification

Classify a changed file before reviewing content.

  1. Source file. The human-authored entry, config, rules, guide, command, or source document that reviewers should inspect for intent.
  2. Generator code. The script, package, workflow, or template that turns source files into derived artifacts.
  3. Generated artifact. A file rebuilt from source or generator code, such as indexes, feeds, bundles, generated docs, snapshots, registry JSON, or README sections.
  4. Build cache or transient output. Local output that should not be committed unless the repository explicitly tracks it.

When the category is unclear, ask the contributor or maintainer to identify the source of truth before approving the diff.

Source-Only Rules

  • Contributor content PRs should add or update exactly the raw source files the issue asks for.
  • Generated artifacts should stay out of contributor PRs unless the repository explicitly requires them.
  • A generated file change without a source input change is a merge blocker until the generator or source explanation is found.
  • A source file change that causes massive generated churn should be reviewed as a source change first, then rebuilt in maintainer automation.
  • Do not accept "I ran the build" as enough evidence when the repository policy says generated output is maintainer-owned.

Generated File Marking

Generated files should be easy for reviewers and platforms to recognize.

  • Use .gitattributes or repository conventions to mark generated paths when appropriate.
  • Keep generated paths predictable, such as public/data/**, dist/**, generated/**, snapshots/**, or repository-specific output directories.
  • Add a short generated-file header only when the file format and project policy support it.
  • Keep source and generated files in separate paths so reviewers can filter noisy output.
  • Update file classification when a generated path becomes hand-authored source or vice versa.

Reproducibility Rules

Generated artifacts are reviewable only when their provenance is clear.

  • Name the command, workflow, or build job that regenerates the artifact.
  • Record the source input path or generator code path that explains the output.
  • Avoid machine-local timestamps, absolute paths, random ordering, host-specific metadata, and environment-dependent output when possible.
  • Pin or document generator versions when output format matters.
  • If generation is intentionally non-deterministic, keep it out of routine contributor PRs and let maintainers publish it through a controlled path.

Reviewer Rules

  • Review raw source first, generated output second.
  • Compare generated artifact changes against the source input that produced them.
  • Ask for a source-only resubmission when generated churn hides a small content change.
  • Treat generator or workflow changes as code changes, not content-only submissions.
  • Confirm that generated artifacts do not include private metadata, local paths, credentials, timestamps, or stale source URLs.
  • Do not merge broad generated rewrites to fix unrelated lint, formatting, ordering, or timestamp changes in a content PR.

Do Not Merge When

  • the PR includes README output, registry feeds, search data, package bundles, previews, or generated JSON when the issue asks for one source file;
  • generated artifacts changed but the source entry, generator code, or command is missing;
  • generated output includes local paths, private identifiers, secret-like values, prompt excerpts, internal reviewer notes, or stale source metadata;
  • the generated diff is mostly timestamp, ordering, formatting, or checksum churn that reviewers cannot reproduce;
  • the contributor changed generator code and content in one PR without explicit maintainer approval;
  • a closed one-shot submission is retried by force-pushing generated fixes instead of opening a clean source-only PR.

Review Checklist

  • {"task": "Source changed", "description": "The PR changes the raw source entry or source input requested by the issue"}
  • {"task": "Generated output excluded", "description": "Generated feeds, indexes, README output, previews, bundles, and snapshots are absent unless project policy requires them"}
  • {"task": "Generator known", "description": "Any generated artifact has a named command, workflow, or generator path"}
  • {"task": "Diff is reproducible", "description": "Generated output avoids unexplained timestamps, random ordering, local paths, and environment-specific metadata"}
  • {"task": "Files are classified", "description": "Generated paths are marked or conventionally separated so reviewers can filter churn"}
  • {"task": "Privacy checked", "description": "Generated files do not expose secrets, private paths, prompts, logs, account IDs, or reviewer notes"}

Troubleshooting

  • The project requires generated files: include the generation command, source input, generator version, and a note that repository policy requires the artifacts.
  • The generated diff is huge: split source changes from generator changes, then let maintainers rebuild artifacts in a separate automation run.
  • The source entry looks correct but generated data is stale: merge the source-only PR only if project policy says generated data is rebuilt after merge.
  • The artifact order changes every run: stabilize sorting or keep the output out of contributor PRs until the generator is deterministic.
  • A generated file contains private data: stop normal review, remove the value at the source, rebuild, and check secondary artifacts before publishing.

Duplicate Check

Checked existing rules, guides, collections, hooks, skills, commands, registry quality code, submission gate code, open PRs, and closed PR history for generated artifact churn, source-only PRs, generated file review, registry artifact policy, large generated diffs, README refresh output, and source-backed content submissions.

Adjacent content includes a source-backed content PR guide, documentation freshness rules, generated-diff hooks, and submission gate code that enforces single-source-file shape. This rules entry is distinct because it gives portable do/don't behavior for reviewers and contributors deciding when generated artifact churn should block or be moved to maintainer automation.

References

#generated-artifacts#registry-quality#source-only-prs#reproducible-generation#gitattributes#review-churn

Source citations

Signals

Loading live community signals…

More like this, weekly

A short, calm digest of reviewed Claude resources. Unsubscribe any time.