[ci-maintainer] sec-check lane retriggers CI by pushing empty commits, which strips lgtm from approved PRs

[clubanderson]

What happened

On 2026-09-08 between 18:26 and 18:41 UTC the sec-check identity (committer sec-check <sec-check@hive.kubestellar.io>) pushed an empty commit titled [architect] ci: retrigger tests (matrix jobs cancelled by concurrency, ...) to five architect PRs that were already green and carried lgtm + approved: #6132, #6142, #6156, #6185, #6257. It did the same on #6292.

Prow removes lgtm on every push, so all five dropped out of Tide's queue and had to be re-reviewed and re-labelled after a full CI cycle. The cancelled matrix jobs it reacted to were superseded runs cancelled on purpose to drain a 260-run queue; the newest run per workflow was intact.

Why it matters

• A push to a reviewed PR resets the review state by design. Re-triggering CI must never go through the branch.
• The retrigger commits carry a committer identity (sec-check) that differs from the signed-off author, which is exactly the shape the probot DCO check rejects on other repos.
• It doubles CI load in the middle of a queue drain.

Ask

1. Use gh run rerun <run-id> --failed (or a workflow_dispatch) to re-kick jobs. Never push to a PR branch to retrigger.
2. Skip any PR that carries lgtm or approved, or has a green newest run per workflow; only act when the newest run for a required workflow is cancelled/failure with no live replacement.
3. Do not act within N minutes of a maintainer cancelling runs on that head (the cancellation actor is visible on the run).

🤖 Generated with Claude Code

https://claude.ai/code/session_01TmdVsn5zULh5KVpFkYrX59

[clubanderson]

Fixed by #6373, merged into v5 (not auto-closed because v5 is not the default branch).