Setting the file. One moment.
Subchapter 15.9
examples/workflow-edit.mdMarkdown3 KBView on GitHub
A worked campaign showing a deterministic recipe and the reference-check that a destructive change requires. Read it for shape, then generalize.
Also bundled
EvalsRecipe type: deterministic (remove a file). Signal type: file-existence (.github/workflows/<name>.yml present). Destructive: yes — so a reference-check pre-step runs before anything is removed.
intent: "Remove the deprecated <name>.yml workflow from every repo that still has it."
scope: multi-repo
target_selector:
enumerate: "gh repo list bitwarden --no-archived --limit 1000 --json name,defaultBranchRef"
applicability_filter:
signal: ".github/workflows/<name>.yml present"
detect: "gh api repos/bitwarden/<repo>/contents/.github/workflows/<name>.yml --jq .sha"
recipe:
type: deterministic
body: "git rm .github/workflows/<name>.yml"
idempotency: "the file is absent → already done, no-op"
validation: "repo lint of remaining workflows (e.g. actionlint if defined) + Skill(perform-preflight)"
pr_spec:
branch: "force-multiplier/retire-<name>-workflow"
title: "[PM-XXXXX] ci: Remove deprecated <name> workflow"
body: "<filled from the repo's PULL_REQUEST_TEMPLATE.md>"
labels: ["ai-review"]
draft: true
safety_policy:
max_targets_per_run: 10
destructive: true
dry_run: false
pilot: required<name> a required status check on the default branch, or is it referenced by another workflow via uses: / workflow_call? Removing a required check blocks every future merge on that repo; removing a called workflow breaks its caller. Any repo where the workflow is depended on is pulled out for a human decision — it does not get auto-removed.git rm the file, second-pass (the diff should be exactly one deleted file — anything more is a red flag), validate, secrets-scan, commit, draft PR.held-back (and why) so the reconciliation selected = applied + already-compliant + skipped-not-applicable + held-back + failed closes. The held-back repos are not failures; they are decisions pending.