🤖 Generated by the Agentic Engineer
Evidence
validate-go-project.yaml's fixer export gate and apply-signed-fixes.yaml's job gate exclude exactly the dependency bots (dependabot[bot], dependabot, renovate[bot], renovatebot, renovate) from receiving auto-fix commits. With signed auto-fixes on by default (#1134), every other same-repository pull-request branch now receives App commits when a fixer changes the tree — including branches owned by other automation: release-please--*, ksail-bot, github-actions[bot], botantler-1[bot]. Before #1134 those were read-only because the flag was off; the exclusion list never considered them. Found in review of #1134.
Impact
Not a privilege change (same repository, same App), but a behaviour change nobody decided: an automation that force-pushes its own branch (release-please does) would overwrite the fixer commit on its next run, and a fixer commit on a bot's branch can make its own check turn on synchronize in ways the bot does not expect. Two designs are defensible — extend the dependency-bot exclusion to every automation identity, or accept fixer commits on any same-repository branch and document it — and the gate's contract test currently pins the five-name list, so either answer is a deliberate change.
Expected behaviour
The set of branches that receive fixer commits is a recorded decision, pinned by the existing contract test, and stated in the README row for apply-signed-fixes.
Acceptance criteria
Rough size: S.
Part of #1075
Evidence
validate-go-project.yaml's fixer export gate andapply-signed-fixes.yaml's job gate exclude exactly the dependency bots (dependabot[bot],dependabot,renovate[bot],renovatebot,renovate) from receiving auto-fix commits. With signed auto-fixes on by default (#1134), every other same-repository pull-request branch now receives App commits when a fixer changes the tree — including branches owned by other automation:release-please--*,ksail-bot,github-actions[bot],botantler-1[bot]. Before #1134 those were read-only because the flag was off; the exclusion list never considered them. Found in review of #1134.Impact
Not a privilege change (same repository, same App), but a behaviour change nobody decided: an automation that force-pushes its own branch (release-please does) would overwrite the fixer commit on its next run, and a fixer commit on a bot's branch can make its own check turn on
synchronizein ways the bot does not expect. Two designs are defensible — extend the dependency-bot exclusion to every automation identity, or accept fixer commits on any same-repository branch and document it — and the gate's contract test currently pins the five-name list, so either answer is a deliberate change.Expected behaviour
The set of branches that receive fixer commits is a recorded decision, pinned by the existing contract test, and stated in the README row for
apply-signed-fixes.Acceptance criteria
test-validate-go-signed-fixes-contract.shandtest-lint-signed-commit.shpin whatever list results, with an ablation.apply-signed-fixesrow states the resulting rule.Rough size: S.
Part of #1075