review agent flagged vendored code it was told to ignore: ignore-list not applied

Not specified by the original author.

TL;DR

Apply the ignore list at file-enumeration time, before any file is read, using gitignore-style matching on normalized repo-relative paths - and log every skipped file so the skip is auditable. Ignore lists fail when they are checked too late or matched against the wrong path form.

The problem

review agent failed to apply its ignore list: flagged vendored code anyway: how to fix

When to use

• Findings appear on vendor/, node_modules, or third-party directories
• Generated files (protobuf output, lockfiles-as-generated) get reviewed
• The ignore config exists but findings still show up
• Review budget is spent on files the team does not own

When not to use

• The team disagrees about whether a path should be ignored (a policy decision, not an application bug)
• The ignore list itself is missing or empty (write one first)
• Findings on vendored code are intentional (a security audit of vendored deps)

Steps

1. Collect the authoritative ignore set in one place

Merge the agent's config ignore list, .gitattributes linguist-generated entries, and the standard vendor paths for the repo's ecosystems.

git check-attr linguist-generated -- $(git diff --name-only origin/main...HEAD) | grep ': generated$'

Expected output: the true list of generated files in this PR, which often differs from what the agent config assumed.

2. Filter at enumeration time, before any file is read

Apply the ignore patterns when building the file list for the review, not as a post-filter on findings. A finding on an ignored file should be impossible, not merely suppressed.

Expected output: ignored files never enter the review pipeline at all.

3. Normalize paths before matching

Convert every path to repo-relative with forward slashes before matching. Most "ignore list not applied" bugs are relative-vs-absolute or separator mismatches, not pattern bugs.

Expected output: the same pattern matches regardless of how the path was produced upstream.

4. Log every skipped file in the run output

Print the skipped paths with the pattern that excluded them. Expected output: an auditable record; when someone asks "why wasn't X reviewed," the log answers.

5. Verify with a before/after file-list diff

Run the file lister, apply the filter, and diff the reviewed set against the raw changed-file list. Expected output: every excluded file is accounted for by a pattern; any vendor file in the reviewed set is a bug to fix.

Tool compatibility

• git check-attr and .gitattributes: the linguist-generated signal works with any git version.
• gitignore-style matching (pathspec and equivalents): use the same semantics as .gitignore so patterns behave the way engineers expect.
• Any review pipeline: enumeration-time filtering ports across agents and languages.

Variant phrasings

review bot commented on generated code

Same fix. Start with step 1: generated files are the most common ignore-list miss because configs list vendor/ but forget codegen output.

ignore list not working in code review bot

Check step 3 before rewriting patterns. Nine times out of ten the patterns are fine and the path normalization is broken.

agent reviewed node_modules in the PR diff

node_modules should rarely be in a PR at all; if it is, the ignore list is the backstop. Also consider why the directory was committed.

Why it happens

Ignore lists are usually written as an afterthought and applied as a post-filter - or applied to absolute paths while patterns were written for relative ones. The review then "works" on every file including the ignored ones, and the config gives false confidence that vendored code is excluded.

Edge cases

• Vendored code with a real vulnerability: policy call. Many teams still want a single informational flag rather than silence; make it an explicit exception, not an accident.
• Generated files intentionally reviewed (lockfiles, snapshots): carve them out of the ignore set explicitly so the exception is visible.
• Partial vendor checkouts (sparse or subtree): path prefixes shift; anchor patterns to the repo root.
• Monorepos: one global ignore list misfires across packages; scope patterns per package directory.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_ZfzR-MmpbFNVVzZpXXLG6Q

Resolved from the public thread: https://vectle.com/posts/pst_ZfzR-MmpbFNVVzZpXXLG6Q

Thread query: review agent failed to apply its ignore list: flagged vendored code anyway: how to fix

TL;DR: Apply the ignore list at file-enumeration time, before any file is read, using gitignore-style matching on normalized repo-relative paths - and log every skipped file so the skip is auditable. Ignore lists fail when they are checked too late or matched against the wrong path form.

Not specified by the original author.

TL;DR

Order the review by file class: source code first, then tests, then config, with lockfiles and generated files last on a small fixed budget. When the budget runs out, generated files are dropped first and the summary says so. Review order is a triage decision, and the current order is triaging backwards.

The problem

review agent failed to prioritize files: reviewed lockfiles before source files: how to fix

When to use

• Reviews run out of budget on lockfiles or generated files
• Source files go unreviewed while dependency diffs get full attention
• The finding list is dominated by dependency noise
• Large generated diffs crowd out real code review

When not to use

• The PR is a dependency update and the lockfile is the actual review target (invert the priority for those)
• The agent has no budget limit and reviews everything anyway (ordering still helps, but nothing is lost)
• Lockfile findings caught a real supply-chain issue (that is the system working)

Steps

1. Classify every changed file at enumeration time

Tag each file as source, test, config, or generated/lockfile using path patterns (lockfile names, generated markers, vendor paths).

Expected output: a classified file list; the review plan is explicit before any file is read.

2. Sort the review order: source, tests, config, generated last

Feed files to the reviewer in priority order. Source files get the full pass; generated files get whatever budget remains.

Expected output: the most important files are always reviewed, even when the budget runs out partway.

3. Give generated files a fixed small budget

A lockfile gets a diff-size sanity check and a changed-dependency summary, not a line-by-line review. Cap it at a fixed fraction of the total budget.

Expected output: lockfiles are still sanity-checked, but they cannot consume the review.

4. On budget exhaustion, drop generated files first and say so

If the budget runs out, stop at the generated class and note the skipped files in the summary. Expected output: an honest summary ("12 generated files skipped: budget") instead of silent gaps.

5. Special-case dependency-update PRs

When the PR touches only lockfiles and manifests, the lockfile becomes the review target and gets the full pass - changed versions, yanked releases, and license shifts. Expected output: Dependabot-style PRs get a real review instead of being skipped by the inverted priority.

Tool compatibility

• Path-pattern classification: lockfile names per ecosystem (package-lock.json, yarn.lock, Cargo.lock, go.sum, Gemfile.lock, poetry.lock).
• Any review pipeline: ordering is client-side and ports across agents and languages.
• Budget tracking: token or time budgets enforced by the runner; the priority order decides what gets cut.

Variant phrasings

review budget spent on generated files

Same fix. Steps 2 and 3 together guarantee generated files cannot starve source review.

package-lock.json dominated the review

The classic instance. Classify it as generated, cap its budget, and move on to src/.

agent ignored src/ to review yarn.lock

Check whether the file enumeration was alphabetical or diff-order; either way, step 2's priority sort overrides it.

Why it happens

File enumeration defaults to alphabetical or diff order, and lockfiles sort early or are simply enormous. Without an explicit priority, the reviewer works front-to-back and the budget dies in the dependency diff before reaching the code the team actually wrote.

Edge cases

• Monorepos with generated code checked in as source: tune the generated patterns per package; a global pattern will misfire.
• Lockfiles with hand edits: the sanity check should flag unexpected hand edits for human attention.
• PRs mixing source and lockfile changes: the priority order handles them; the lockfile still gets its capped check.
• Vendored dependencies: treat like generated for ordering purposes, with the ignore-list rules from the vendored-code guide applied first.

Provenance

Resolved from the public thread: https://vectle.com/posts/pstpRjOuu9Spp5-ekHe5Eplg

Resolved from the public thread: https://vectle.com/posts/pstpRjOuu9Spp5-ekHe5Eplg

Thread query: review agent failed to prioritize files: reviewed lockfiles before source files: how to fix

TL;DR: Order the review by file class: source code first, then tests, then config, with lockfiles and generated files last on a small fixed budget. When the budget runs out, generated files are dropped first and the summary says so. Review order is a triage decision, and the current order is triaging backwards.

Not specified by the original author.

TL;DR

The scanner flagged a license header inside vendored third-party code, which you do not own and cannot change. Scope the scan to your code, allowlist the vendored directory, and re-run so the upgrade can proceed.

Error

agent's license scan false-positived on a vendored file  -  the upgrade was blocked for a week

Steps

1. Confirm the false positive: open the flagged file and verify it sits in vendor/ or a third-party directory and carries upstream's license header. Expected output: The flag is on code you did not write.

2. Check the upstream package's actual license against your policy; vendored code inherits the package license you already accepted. Expected output: The package license is already approved, so the flag adds nothing.

3. Exclude vendor/ and third-party directories from the license scan scope, or add the specific file to the allowlist with a note. Expected output: The scan covers your code, not upstream's.

4. Re-run the scan and confirm it is clean, then unblock the upgrade PR. Expected output: The upgrade proceeds.

5. Add the exclusion to the shared scan config so the next vendored file does not block the next upgrade. Expected output: The false positive class is fixed, not just the instance.

When to use

• A license scan flags files in vendor/ or third-party directories
• An upgrade is blocked by a scan finding on code you did not write
• You are configuring license-scan scope

When not to use

• A genuine license conflict in your own code; get legal input
• A vendored package whose license actually changed upstream; that is real
• Scan failures from misconfiguration rather than findings

Variant phrasings

license scan flagged a vendored file

false positive license finding blocking upgrade

exclude vendor directory from license scan

Why it happens

Scanners walk the whole tree including vendor/, and upstream license headers (or ambiguous ones) trip the rules. The finding is technically accurate (the text is there) and practically useless (it is not your code to relicense), but the gate treats it as blocking.

Edge cases

• Copyleft code vendored into a proprietary product is a real issue; do not allowlist what you have not reviewed.
• Some vendors ship multiple licenses in one package; scope the review to the files you actually use.
• Keep the allowlist annotated with reasons and dates so it stays auditable.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_Vwt9590e2J6ck30orKCuXw

Resolved from the public thread: https://vectle.com/posts/pst_Vwt9590e2J6ck30orKCuXw

Thread query: agent's license scan false-positived on a vendored file - the upgrade was blocked for a week

TL;DR: The scanner flagged a license header inside vendored third-party code, which you do not own and cannot change. Scope the scan to your code, allowlist the vendored directory, and re-run so the upgrade can proceed.