Docs-only. CLAUDE.md still described the Renovate review-verdict/h10 auto-pass as identity-only — "auto-passed as a bot PR unless they touch .claude//.gitea//.husky//scripts//docker/ci/".
Since #698 that is no longer the rule. The auto-pass now requires both: no protected path and every changed path being a dependency manifest (Directory.Packages.props, .config/dotnet-tools.json). A bot account does not attribute the code at a head — pull_request.user.login is the PR's immutable creator, while the head it points at is not.
CLAUDE.md is loaded into every session, so a stale rule there propagates further than a stale doc would. Caught by the /done docs-impact check after #705 merged; docs/ci-cd.md and the decision records were already correct.
Practical effect worth knowing: a Renovate PR touching a .csproj or a source file is not blocked, it simply needs a real verdict.
refs #698
Docs-only. `CLAUDE.md` still described the Renovate `review-verdict/h10` auto-pass as identity-only — "auto-passed as a bot PR unless they touch `.claude/`/`.gitea/`/`.husky/`/`scripts/`/`docker/ci/`".
Since #698 that is no longer the rule. The auto-pass now requires **both**: no protected path **and** every changed path being a dependency manifest (`Directory.Packages.props`, `.config/dotnet-tools.json`). A bot *account* does not attribute the *code* at a head — `pull_request.user.login` is the PR's immutable creator, while the head it points at is not.
`CLAUDE.md` is loaded into every session, so a stale rule there propagates further than a stale doc would. Caught by the `/done` docs-impact check after #705 merged; `docs/ci-cd.md` and the decision records were already correct.
Practical effect worth knowing: a Renovate PR touching a `.csproj` or a source file is not blocked, it simply needs a real verdict.
CLAUDE.md still described the bot exemption as identity-only (auto-passed unless a
protected path is touched). Since #698 it also requires EVERY changed path to be a
dependency manifest — a bot account does not attribute the code at a head. CLAUDE.md is
loaded every session, so a stale rule here is worse than a stale doc.
Refs: #698
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
timothy
merged commit 81be685df9 into main2026-07-30 21:58:04 +02:00
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
refs #698
Docs-only.
CLAUDE.mdstill described the Renovatereview-verdict/h10auto-pass as identity-only — "auto-passed as a bot PR unless they touch.claude//.gitea//.husky//scripts//docker/ci/".Since #698 that is no longer the rule. The auto-pass now requires both: no protected path and every changed path being a dependency manifest (
Directory.Packages.props,.config/dotnet-tools.json). A bot account does not attribute the code at a head —pull_request.user.loginis the PR's immutable creator, while the head it points at is not.CLAUDE.mdis loaded into every session, so a stale rule there propagates further than a stale doc would. Caught by the/donedocs-impact check after #705 merged;docs/ci-cd.mdand the decision records were already correct.Practical effect worth knowing: a Renovate PR touching a
.csprojor a source file is not blocked, it simply needs a real verdict.