fix(workflow): point Learning Hub Updater allowed-files at website content collection 🤖🤖🤖

[muhammadumer-waheed]

What

The daily Learning Hub Updater agentic workflow keeps failing with a code-push guardrail error:

create_pull_request: Cannot create pull request: patch modifies files outside the allowed-files list.

Blocked files (from the failed runs): website/src/content/docs/learning-hub/building-custom-agents.md, website/src/content/docs/learning-hub/copilot-configuration-basics.md, website/src/content/docs/learning-hub/creating-effective-skills.md, website/src/content/docs/learning-hub/agents-and-subagents.md, website/src/content/docs/learning-hub/installing-and-using-plugins.md.

Root cause

The Learning Hub content now lives in website/src/content/docs/learning-hub/ (the website/learning-hub/ directory no longer exists in the repo), but the workflow's safe-outputs allowed-files globs were never updated and still point at website/learning-hub/**/*.md. So valid content updates are rejected by the guardrail and the workflow reports a failure every time it has something to update.

Changes

• .github/workflows/learning-hub-updater.md
  • create-pull-request.allowed-files: website/learning-hub/**/*.md → website/src/content/docs/learning-hub/**/*.md
  • push-to-pull-request-branch.allowed-files: same update
  • Updated the two stale website/learning-hub path references in the prompt to the current location
• .github/workflows/learning-hub-updater.lock.yml — regenerated with gh aw compile (v0.88.8, the same compiler version the existing lock was generated with), so only the safe-outputs config and source hashes change; no manifest/dependency churn

The new glob matches the same layout convention already used by advanced-copilot-cli-sync (website/src/content/docs/learning-hub/advanced-copilot-cli/**).

Verification

• gh aw compile .github/workflows/learning-hub-updater.md → compiles successfully, 0 warnings
• Diff is limited to the allowed-files globs, prompt path references, and the regenerated hashes/config in the lock file
• bash eng/fix-line-endings.sh run before committing

Fixes #3736
Fixes #3720

[github-actions]

🚦 Submission status: ⏳ Awaiting automation

Risk tier: merge-risk:high — Privileged execution, automation, or review-policy change
Required to merge: passing submission-gate checks plus 2 approvals from reviewers with write access, including a maintainer with admin or maintain permission.

Why this tier

• .github/workflows/learning-hub-updater.lock.yml is a high-risk path (automation, scripts, MCP config, hooks, or review policy)
• .github/workflows/learning-hub-updater.md is a high-risk path (automation, scripts, MCP config, hooks, or review policy)

Automated checks

Check	Status	Details
Line endings	✅ Passed	Passed · logs
Spelling	✅ Passed	Passed · logs
Submission gate tests	🔧 Infrastructure failure	The check did not report a result for this commit
Contributor reputation	✅ Passed	Passed · logs
Duplicate resource scan	✅ Passed	Passed · logs
PR quality signal	⏭️ Skipped	Skipped by its workflow · logs
Contributor risk signal	🔧 Infrastructure failure	The contributor check succeeded but its result artifact was missing, unreadable, or for another commit · logs

Action needed

• 🔧 Submission gate tests, Contributor risk signal hit an automation problem that is not caused by your contribution. Comment /rerun-checks to retry; maintainers are notified if it keeps failing.

Review

• Approvals: 1/2 (aaronpowell)
• Assigned reviewer: not assigned yet — comment /request-review to ask for one
• Review target date: not set
• Still needed: 1 more approval(s)
• The core-maintainers pool is not staffed yet; an approver with admin or maintain permission is required instead.

Commands

Command	Who	What it does
/rerun-checks	PR author, maintainers	Re-runs failed or incomplete checks and re-evaluates this gate
/request-review	PR author, maintainers	Asks the review rotation to assign a reviewer (adds needs-reviewer)

_{Updated for 842c802 · gate run · This comment is maintained automatically — see submission gate docs.}