[mikepenz]

The commit-dist job condition used github.actor to detect Renovate PRs, but github.actor reflects whoever triggered the run — not who opened the PR. When the repo owner manually re-runs CI on a Renovate PR, github.actor becomes mikepenz and the job is incorrectly skipped.

Fix: use github.event.pull_request.user.login instead, which always reflects who opened the PR regardless of who triggered the run.

[github-actions]

	Tests	Passed ✅	Skipped	Failed
JUnit Test Report	67 ran	67 passed	0 skipped	0 failed

Test	Result
No test annotations available

• View JUnit Test Report

[Copilot]

Pull request overview

Adjusts automation around Renovate PR handling so the commit-dist job runs under the correct circumstances, and tweaks Renovate vulnerability alert labeling.

Changes:

• Updates commit-dist job gating logic in CI workflow for Renovate PRs.
• Adds dependencies label to Renovate vulnerability alert issues.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

File	Description
renovate.json	Expands vulnerability alert labels to include dependencies.
.github/workflows/ci.yml	Modifies commit-dist conditional logic intended to detect Renovate PRs and handle re-runs.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

The new commit-dist condition still relies on github.actor (now comparing it to github.repository_owner). This appears to reintroduce the original problem described in the PR (the trigger actor can change on re-runs) and also prevents commit-dist from running on the initial Renovate PR run (where github.actor is typically renovate[bot]). To match the PR description and make the condition stable across re-runs, key the check off the PR author instead (e.g., github.event.pull_request.user.login) and avoid gating on github.actor for Renovate detection.

Suggested change

	github.actor == github.repository_owner
	github.event.pull_request.user.login == 'renovate[bot]'

[Copilot]

This change to vulnerabilityAlerts.labels adds the dependencies label, but the PR description focuses only on the commit-dist workflow condition change. If this label change is intended, it should be called out in the PR description (or split into a separate PR) to keep the scope clear.