Broad *.txt match in doc-only allowlist may skip review of dependency manifests #48

Non-Blocking Review Concern: Broad *.txt match in doc-only allowlist may skip review of dependency manifests

Source: claude (self-review bot)
Location: .github/workflows/claude-blocking-review.yml:149
PR: #47 — feat: doc-only fast-skip + SHA marker + prior-comment collapse (#47)
Date: 2026-04-18

What was flagged

The doc-only allowlist matches all *.txt files, which would classify dependency manifests like requirements.txt, constraints.txt, or packages.txt as doc-only and skip the Claude review. The PR correctly excluded CODEOWNERS and dependabot.yml for security reasons but did not apply the same reasoning to .txt dependency files. Consider restricting to known-safe prose extensions (.md, .rst) or explicitly excluding common dependency manifest filenames.

Context

This issue was automatically created from a non-blocking concern identified
during pre-merge review of PR #47. It was safe to merge but worth tracking.

Created by lib-review-issues.sh