Repository navigation
[scanner] Gate proposal: netlify deploy-preview ignore allowlist drifts per lane #439
Description
Gate proposal: Netlify deploy-preview ignore rule is an allowlist that drifts
netlify.toml [context.deploy-preview].ignore is a hand-maintained list of branch-prefix globs. Every new hive lane that opens a PR against this repo builds a deploy preview (draining the Netlify quota, #419) until someone notices and patches the list again. Four patches so far, same root cause, different site each time:
| PR | Lanes added |
|---|---|
| #420 | scanner/* quality/* hive/* dependabot/* |
| #425 | arch/* |
| #427 | sec/* outreach/* ops/* automation/* |
| #436 | guide/* |
Current rule (netlify.toml:51):
case "${HEAD:-$BRANCH}" in arch/*|guide/*|scanner/*|quality/*|sec/*|outreach/*|ops/*|automation/*|hive/*|dependabot/*) exit 0;; *) exit 1;; esac
Nothing guards this: no CI check compares the list against the lanes that actually open PRs, so the fifth lane (reviewer/*, feat/*, fix/*, generated/*, … already exist on sibling repos) will drift it again.
Decision requested (a maintainer call because it changes which human PRs get previews and touches Netlify spend):
- A — invert to an allowlist of human prefixes: skip previews by default; build only for branches that do NOT match
*/*(plainfeature-xnames) plus an explicit opt-in prefix such aspreview/*. Simple, never drifts, but contributors who useuser/topicbranches lose previews unless they rename or opt in. - B — keep the denylist but gate it: add a CI step (in the existing
Lint and buildworkflow) that fails when the PR's own head branch prefix is a bot author (github.event.pull_request.user.type == 'Bot') and is not matched by the ignore rule, so the drift is caught on the first PR from a new lane instead of after the quota burns. No behaviour change for humans. - C — skip previews for every PR whose author is a bot, independent of branch name: Netlify does not expose the PR author to
ignore, so this needs the preview to be driven from GitHub Actions (e.g. adeploy-previewjob that only runs foruser.type != 'Bot') rather than Netlify's own PR integration — the largest change, but the only one keyed on the actual signal.
Recommendation: B now (additive, no behaviour change), revisit A/C if the quota keeps burning.
Risk: governance
— hive: agent=scanner backend=copilot model=claude-fable-5.1 copilot=1.0.88
Activity
hivecommons-hive commentedon Oct 24, 2026
What to reply
/hive approve: go with the recommendation/hive decision <your instructions>: go ahead, following your instructions/hive help: show these againIf what this issue waited on has been done (a merged fix, or an action taken outside this repository), a maintainer can reply
/fixedto close it as completed; Hive clears its park labels.Only a maintainer with write access can un-park; everything else is ignored. Full command reference: https://github.com/hivecommons/hive/blob/v5/src/docs/maintainer-commands.md.
clubanderson commentedon Oct 24, 2026
/hive decision B now, as recommended — add the CI step that fails when a Bot-authored PR's head prefix is not in the
netlify.tomlignore rule, so drift is caught on the first PR from a new lane. Also add the lanes that already exist on sibling repos (reviewer/*,feat/*,fix/*,generated/*,docs-rot-*) in the same PR. Revisit C only if the quota keeps burning after that.hivecommons-hive commentedon Oct 24, 2026
Un-parked by @clubanderson. Decision: B now, as recommended — add the CI step that fails when a Bot-authored PR's head prefix is not in the
netlify.tomlignore rule, so drift is caught on the first PR from a new lane. Also add the lanes that already exist on sibling repos (reviewer/*,feat/*,fix/*,generated/*,docs-rot-*) in the same PR. Revisit C only if the quota keeps burning after that.stage/045-needs-decisionis cleared when present andapproved-directionis applied; anyholdlabel is left exactly as it was.hivecommons-hive commentedon Oct 24, 2026
🔒 Claimed by @arteeh (contributor on hive hosted-available-oke-11-placeholder-r05x). The claim lasts 30m0s without activity and renews while the work continues. Reply
/unclaimto release, or/claimto take it over if you outrank the holder.hivecommons-hive commentedon Oct 24, 2026
🔓 Claim by @arteeh released (lease revoked).
hivecommons-hive commentedon Oct 24, 2026
🌱 Good first issue — bring your own coding agent
Hi! This repository is maintained with hive and welcomes contributions made with your own AI coding agent (Claude Code, Codex, Copilot CLI, Bob, …). hosted-available-oke-11-placeholder-r05x picked this issue as a good place to start because:
How to land it (no waiting on a human):
git commit -s).Fixes #439— that closing keyword is how hive's contributor lane links the PR to your claim.Paste this to your agent
Prefer not to drive the loop by hand? Run your own hive (we call them clankers) — a relay on your machine that claims, opens the PR and handles review fixes for you, and earns you a contributor profile and a leaderboard place: see https://hosted-kubestellar-hive-ojv6.hive.hivecommons.dev/contribute.
If nobody claims it, hive may pick it up itself — claiming first prevents that. Docs: contributor relay · contributor lane auto-merge · trust tiers.
fix(ci): gate bot deploy-preview ignore drift (#447)