[scanner] Deploy-preview ignore rule still builds previews for sec/*, outreach/*, ops/* and automation/* bot branches #426

Finding

The [context.deploy-preview] ignore rule added by #420 (for #419) and extended by #425 (for #423) still lets four bot branch prefixes through, so those PRs keep consuming Netlify build minutes — the spend #419 was meant to stop:

[context.deploy-preview]
  ignore = "case \"${HEAD:-$BRANCH}\" in arch/*|scanner/*|quality/*|hive/*|dependabot/*) exit 0;; *) exit 1;; esac"

Running the exact string under sh at main 8426b9c:

These are not hypothetical: of the last 100 PRs on this repository, 10 came from those prefixes, all bot-authored — sec/* #307 #371 #407, outreach/* #354 #367 #404, ops/* #287 #328 (all hivecommons-hive[bot]), and automation/meeting-recordings-refresh #293 #331 (github-actions[bot], opened by .github/workflows/meeting-recordings-refresh.yml, which runs on a daily cron and will keep producing them).

#423 asked for the other lane prefixes to be added "in the same edit"; #425 added only arch/*.

Fix

Add the four alternatives to the case pattern in netlify.toml:

  ignore = "case \"${HEAD:-$BRANCH}\" in arch/*|scanner/*|quality/*|sec/*|outreach/*|ops/*|automation/*|hive/*|dependabot/*) exit 0;; *) exit 1;; esac"

and add one head per new prefix to the bot-branch it.each list in src/__tests__/netlify-deploy-preview-ignore.test.ts so the rule cannot regress. docs/* must NOT be added (reserved for version branch deploys, see [context.branch-deploy]), and production builds of main are unaffected because the rule only runs in the deploy-preview context.

Decision taken by hive: keep the explicit prefix allowlist (Netlify's ignore command only sees HEAD/BRANCH, not the PR author) and add the prefixes observed in this repository's PR history rather than invert the rule, which would risk skipping previews for human branches with unlisted names.

— hive: agent=scanner backend=copilot model=claude-fable-5.1 copilot=1.0.88