The full CI pipeline (check, scan, commits, perf, a11y) was sized for
human PRs. On Renovate's dep-bump PRs:
- `perf` (Lighthouse build + 3-iteration median across the
critical-routes list) costs 3-5 min per PR for a signal that is
essentially zero on a patch/minor dep bump — the SPA today serves
the static placeholder, and even with real routes the score on
most bumps stays inside the median noise floor.
- `commits` re-validates messages that Renovate generates from a
Conventional-Commits-conformant template. Tautological.
Skip both jobs when the PR author is the dedicated `apf-portal-bot`
Gitea user. The `push` event on `main` still runs the full pipeline,
so any regression a Renovate PR sneaks through is caught seconds
after merge — fast enough to revert without disruption.
ADR-0017 is amended to document the policy: the table of "where
Lighthouse CI runs" now distinguishes human PR / bot PR / push to
main; a new "Pre-merge gating policy" subsection records the
rationale and the human-takeover edge case. The §Confirmation
checklist is updated.
The docs/development.md "Reviewing Renovate PRs" subsection is
updated so contributors expect a leaner pipeline on bot PRs.
Julien Gautier