From 51d9c95582955a0c8be9135aac39a62859724185 Mon Sep 17 00:00:00 2001 From: "Zeyu (Zayne) Zhang" Date: Sat, 5 Sep 2026 16:22:56 +0800 Subject: [PATCH 1/3] docs(code-review): clarify bot trust gates --- code-review/config.mdx | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/code-review/config.mdx b/code-review/config.mdx index b7f9a0b..a913f48 100644 --- a/code-review/config.mdx +++ b/code-review/config.mdx @@ -79,10 +79,12 @@ The `exclude` block tells Hacktron not to scan a pull or merge request. A match GitHub bot PRs are reviewed automatically only when the source branch belongs to the same repository. Bot PRs from forks and PRs from outside human - contributors are not scanned automatically. GitLab and Bitbucket bot or - service accounts follow the normal coverage, filter, and seat rules. An - eligible bot author can take a Code Review seat when auto-assignment is on. - Add its username to `exclude.authors` to skip its future PRs or MRs. + contributors are not scanned automatically. On GitLab, a bot or service + account follows the normal filter and seat rules when it has Developer or + higher project access. On Bitbucket, the same applies to PRs from the target + repository, while fork PRs are not scanned automatically. An eligible bot + author can take a Code Review seat when auto-assignment is on. Add its + username to `exclude.authors` to skip its future PRs or MRs. Rules are evaluated in this order, first match applies: From f8fb28735013b1cf5dd42552f752bf83d1cbb855 Mon Sep 17 00:00:00 2001 From: "Zeyu (Zayne) Zhang" Date: Sat, 5 Sep 2026 16:33:28 +0800 Subject: [PATCH 2/3] docs(code-review): distinguish Bitbucket trust rules --- code-review/config.mdx | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/code-review/config.mdx b/code-review/config.mdx index a913f48..f454cd9 100644 --- a/code-review/config.mdx +++ b/code-review/config.mdx @@ -81,10 +81,11 @@ The `exclude` block tells Hacktron not to scan a pull or merge request. A match to the same repository. Bot PRs from forks and PRs from outside human contributors are not scanned automatically. On GitLab, a bot or service account follows the normal filter and seat rules when it has Developer or - higher project access. On Bitbucket, the same applies to PRs from the target - repository, while fork PRs are not scanned automatically. An eligible bot - author can take a Code Review seat when auto-assignment is on. Add its - username to `exclude.authors` to skip its future PRs or MRs. + higher project access. On Bitbucket, a bot or service account follows the + normal filter and seat rules when its source branch belongs to the target + repository; fork PRs are not scanned automatically. An eligible bot author can + take a Code Review seat when auto-assignment is on. Add its username to + `exclude.authors` to skip its future PRs or MRs. Rules are evaluated in this order, first match applies: From e03ecd3b4ad3abed258159f548170057fb402ce6 Mon Sep 17 00:00:00 2001 From: "Zeyu (Zayne) Zhang" Date: Sat, 5 Sep 2026 16:39:39 +0800 Subject: [PATCH 3/3] docs(code-review): simplify bot trust guidance --- code-review/config.mdx | 16 ++++++---------- 1 file changed, 6 insertions(+), 10 deletions(-) diff --git a/code-review/config.mdx b/code-review/config.mdx index f454cd9..f831b36 100644 --- a/code-review/config.mdx +++ b/code-review/config.mdx @@ -74,18 +74,14 @@ Every key is optional. An empty or absent `config.yaml` doesn't disable filterin ## Exclude scans -The `exclude` block tells Hacktron not to scan a pull or merge request. A match records a **skipped** check and uses no developer seat. On GitHub, excluded bot PRs do not receive a skip comment. +The `exclude` block tells Hacktron not to scan a pull or merge request. A match records a **skipped** check and uses no developer seat. - GitHub bot PRs are reviewed automatically only when the source branch belongs - to the same repository. Bot PRs from forks and PRs from outside human - contributors are not scanned automatically. On GitLab, a bot or service - account follows the normal filter and seat rules when it has Developer or - higher project access. On Bitbucket, a bot or service account follows the - normal filter and seat rules when its source branch belongs to the target - repository; fork PRs are not scanned automatically. An eligible bot author can - take a Code Review seat when auto-assignment is on. Add its username to - `exclude.authors` to skip its future PRs or MRs. + Hacktron automatically reviews bot-authored changes only when the provider + identifies the bot as trusted for the target repository. Untrusted bots and + outside contributors are not auto-scanned. Eligible bots follow the same + filters and seat rules as other authors. Add a bot's username to + `exclude.authors` to skip its future changes. Rules are evaluated in this order, first match applies: