Non-Blocking Review Concern: Broad *.txt match in doc-only allowlist may skip review of dependency manifests
Source: claude (self-review bot)
Location: .github/workflows/claude-blocking-review.yml:149
PR: #47 — feat: doc-only fast-skip + SHA marker + prior-comment collapse (#47)
Date: 2026-04-18
What was flagged
The doc-only allowlist matches all *.txt files, which would classify dependency manifests like requirements.txt, constraints.txt, or packages.txt as doc-only and skip the Claude review. The PR correctly excluded CODEOWNERS and dependabot.yml for security reasons but did not apply the same reasoning to .txt dependency files. Consider restricting to known-safe prose extensions (.md, .rst) or explicitly excluding common dependency manifest filenames.
Context
This issue was automatically created from a non-blocking concern identified
during pre-merge review of PR #47. It was safe to merge but worth tracking.
Created by lib-review-issues.sh
Non-Blocking Review Concern: Broad *.txt match in doc-only allowlist may skip review of dependency manifests
Source: claude (self-review bot)
Location:
.github/workflows/claude-blocking-review.yml:149PR: #47 — feat: doc-only fast-skip + SHA marker + prior-comment collapse (#47)
Date: 2026-04-18
What was flagged
The doc-only allowlist matches all
*.txtfiles, which would classify dependency manifests likerequirements.txt,constraints.txt, orpackages.txtas doc-only and skip the Claude review. The PR correctly excluded CODEOWNERS and dependabot.yml for security reasons but did not apply the same reasoning to.txtdependency files. Consider restricting to known-safe prose extensions (.md,.rst) or explicitly excluding common dependency manifest filenames.Context
This issue was automatically created from a non-blocking concern identified
during pre-merge review of PR #47. It was safe to merge but worth tracking.
Created by lib-review-issues.sh