[sophiecarreras]

What

An area-owner approval now counts only if its commit_id equals the PR's current head SHA, so a new push needs fresh approvals. A CHANGES_REQUESTED review still blocks regardless of commit, so a new commit never silently clears it. The PR author is still implicitly approved for areas they own. Follows intent/review-process/intent.md, point 2 ("Approvals cover one commit").

Changes in .github/workflows/require-area-approvals.yml (+8/-2):

• Header comment updated to describe the new rule.
• HEAD_SHA is exported so the Python step can read it.
• An APPROVED review whose commit_id is not the head SHA is recorded as STALE_APPROVED, which counts for nothing.

Unchanged: Dependabot guard, CODEOWNERS parsing, write-permission filtering, fail-safe red, area-owner-approvals status name. pull_request already has synchronize, so a push re-evaluates.

Risk

.github/workflows/ is a High-tier path. The area-owner-approvals status is a soft, non-blocking signal, so the effect is that approvals go stale after each push and owners must re-approve. A review with no commit_id is treated as stale. An empty or rebase-only push also invalidates approvals.

How to revert

Revert the single commit.

Testing

Ran the extracted Python step offline against a hand-made reviews fixture (head SHA new):

• alice APPROVED on old only: failure, awaiting.
• bob APPROVED on new only: success.
• alice APPROVED on old + carol CHANGES_REQUESTED on old: failure, changes requested by carol.
• all three plus bob on new: failure, changes requested by carol.

Not verified: actionlint/yamllint not installed (YAML parse only); pathspec stubbed (only the * rule); not run on a live PR.

Changelog

No library code changed, so no .changes/unreleased entry. Needs the skip-changelog label.

🤖 Generated with Claude Code

[sophiecarreras]

Superseded by #259, opened from a branch in this repo so the area-owner-approvals workflow gets a token that can post commit statuses (fork PRs get a read-only token).