[quality] refresh-community-people.yml validates nothing it generates #737

Finding

.github/workflows/refresh-community-people.yml rewrites data/community-people.json every Monday and opens an automation PR, but it runs no validator and no tests against the file it just generated. Its only steps are:

      - run: npm ci
      - run: npm run fetch:community-people
      - run: npm run build

Two gates that exist in this repo are skipped:

• npm run validate:community-people — the dedicated validator, which ci.yml runs and which passes on main today (Validated 16 community profiles).
• npm run test:unit — which contains tests/community-people-data.test.mjs, the data-contract suite that reads the real data/community-people.json and enforces, among other things, that every github/linkedin/twitter value matches /^[A-Za-z0-9][A-Za-z0-9._-]*$/, because src/components/CommunityPeople interpolates those values into profile URLs unescaped. The sibling workflows import-architectures.yml and refresh-radar-reports.yml both run npm run test:unit; this one does not.

npm run build is not a substitute: Docusaurus will happily render a profile whose handle contains a slash or a query string.

The usual backstop — the Validate repository workflow in ci.yml, which is on: pull_request — does not apply either. The PR is opened by peter-evans/create-pull-request with its default token (github.token, i.e. GITHUB_TOKEN), and GitHub does not start workflow runs for events raised by GITHUB_TOKEN. Evidence: the current automation PR #681 has exactly one check on it, DCO, which is a GitHub App rather than a workflow.

Net effect: a regenerated data/community-people.json can reach main having passed no validator and no test at any point.

Recommendation

Add the two gates to the workflow, after the fetch step so they see the regenerated file. Replace:

      - run: npm ci
      - run: npm run fetch:community-people
      - run: npm run build

with:

      - run: npm ci
      - run: npm run fetch:community-people
      - run: npm run validate:community-people
      - run: npm run test:unit
      - run: npm run build

That is the whole change; no other file is affected.

Separately worth considering (out of scope for this issue): giving create-pull-request a token that is not GITHUB_TOKEN so ci.yml runs on automation PRs at all.

Completion criterion

• refresh-community-people.yml runs npm run validate:community-people after fetch:community-people
• refresh-community-people.yml runs npm run test:unit after fetch:community-people

Needs a human

The fix is entirely inside .github/workflows/. The agent that found this holds a contributor-tier App token, which does not carry the workflows permission, so any push touching .github/workflows/** is rejected by GitHub server-side. This issue therefore has no accompanying PR — that is a hard credential ceiling, not a judgement that the change is unready. The replacement text above is exact and applying it is mechanical; it needs a human maintainer or an agent with the workflows permission to land.

Priority

• Impact: high — the failure mode is unvalidated, unescaped profile data reaching the published site
• Effort: low — two added lines

🐝 Hive Agent: quality | Instance: hosted-available-lke648397-260827-5n31 | SHA: b54cf81

— hive: agent=quality backend=copilot model=claude-opus-5 copilot=1.0.88