ossf
Feature: Code Review Check handle commits made by version bump bots
Is your feature request related to a problem? Please describe.
Discussion started at https://github.com/electron/electron/pull/35741#pullrequestreview-1118960274
Just oppening the discussion about the commits made automatically by some bots that, depending on its access rights and on its complexity, can not represent a big security risk.
We have some situations where it is not reasonable for the project to review every single commit made by the bot, since it is a very frequent and automatic job. But, by the other hand, allowing an ignore list for bots also leaves the door open to other projects excluding bots that might be more susceptible to compromise.
Describe the solution you'd like The Code Review Check could handle, somehow, commits made by version bump bots, that just updates the version of the project itself, not of its dependencies.
Describe alternatives you've considered I've consider to allow the user to exclude commits made by the bot, but this has the turnaround mentioned above of leaving the door open to other projects excluding bots that might be more susceptible to compromise.
Additional context Add any other context or screenshots about the feature request here.
I think this likely regressed in #2260. Our new approach would be to check if the authors of a change were bots. Previously we used User.Login (API), but I think we should use User.Type instead
