Triage: open issue/PR overlaps, consolidation candidates, and merge order (2026-09-28)

[mrbobbytables]

Purpose

A pass over the current 23 open issues and 13 open PRs in cncf/endusers to flag likely duplicates/overlaps, propose consolidations, and set a priority and merge order. All PR numbers/CI states below were verified live via gh pr view/gh issue view at time of writing. No hold-labeled item was merged or modified as part of this triage (per GOVERNANCE.md).

Overlaps and duplicate candidates

1. Strengthen the static/ asset security gate: discover directories dynamically and block external references in SVGs #754 vs [sec-check] SVG active-content gate does not flag remote resource references, so an imported diagram can hot-link a third-party host #774/fix(security): gate remote resource references in imported SVG diagrams #775 (PR) — Strengthen the static/ asset security gate: discover directories dynamically and block external references in SVGs #754 ("Strengthen the static/ asset security gate") explicitly consolidates [sec-check] static/ security gate covers a hardcoded directory list, so a new static/ subdirectory is ungated with no CI signal #697 and [sec-check] SVG gate has no external-reference check: an imported diagram can hot-link a third-party host from the site origin #745, and one of its two goals — "extend the SVG gate to reject external URL references" — is the same fix PR fix(security): gate remote resource references in imported SVG diagrams #775 delivers for [sec-check] SVG active-content gate does not flag remote resource references, so an imported diagram can hot-link a third-party host #774. Once fix(security): gate remote resource references in imported SVG diagrams #775 merges, Strengthen the static/ asset security gate: discover directories dynamically and block external references in SVGs #754 should be narrowed to only its remaining goal (dynamic discovery of static/ subdirectories) or split into a new, smaller issue so it isn't left describing already-shipped work.
2. Automation workflows must validate and format what they generate before committing #755 vs PR test: guard regenerate-format-validate-test ordering for data-generating automation jobs #758 — PR test: guard regenerate-format-validate-test ordering for data-generating automation jobs #758 adds a contract test that guards the "regenerate → format → validate → test" ordering Automation workflows must validate and format what they generate before committing #755 asks for, it does not reorder the four automation workflows ([quality] Import job never runs check:format, so every architecture import PR carries 16 unformatted files #713, [sec-check] refresh-community-people.yml commits third-party profile data without running validate:community-people #736, [quality] automation workflows run test:unit before regenerating the data it guards #738, [sec-check] deploy-gh-pages.yml publishes after running only 4 of 10 data validators #740) that Automation workflows must validate and format what they generate before committing #755 is about. Merging test: guard regenerate-format-validate-test ordering for data-generating automation jobs #758 will make CI red for those workflows (that's the point — it turns the gap into a visible failure) but must not be read as closing Automation workflows must validate and format what they generate before committing #755; the actual workflow-ordering fix is still unwritten.
3. [ci-maintainer] Automated import PRs run no CI: GITHUB_TOKEN-created PRs do not trigger pull_request workflows #721 vs chore: refresh community profiles #763 / chore: import latest reference architectures #681 (PRs) — [ci-maintainer] Automated import PRs run no CI: GITHUB_TOKEN-created PRs do not trigger pull_request workflows #721 ("Automated import PRs run no CI") is not theoretical: both open automation PRs (chore: refresh community profiles #763 refresh-community-people, chore: import latest reference architectures #681 import-architectures) are currently mergeStateStatus: BLOCKED because branch protection is waiting on a Validate repository check that GITHUB_TOKEN-authored PRs never trigger. These two PRs are live evidence for [ci-maintainer] Automated import PRs run no CI: GITHUB_TOKEN-created PRs do not trigger pull_request workflows #721 and are stuck until it's fixed (or a maintainer manually re-runs/approves).
4. [quality] site search indexes only the blog: docsRouteBasePath default does not match docs routeBasePath #769 vs PR test: cover the local site search end to end #771 — [quality] /search and the local search index have no end-to-end coverage #770 (search e2e coverage, closed by PR test: cover the local site search end to end #771) and [quality] site search indexes only the blog: docsRouteBasePath default does not match docs routeBasePath #769 (site search indexes only the blog, a real product bug) were discovered together. Confirm whether test: cover the local site search end to end #771's new spec asserts today's broken behavior (docs pages missing from the index) — if so it will need a follow-up once [quality] site search indexes only the blog: docsRouteBasePath default does not match docs routeBasePath #769 lands, or should be written against the fixed behavior with [quality] site search indexes only the blog: docsRouteBasePath default does not match docs routeBasePath #769 as a blocking dependency.
5. [quality] Two unreachable defensive sub-expressions permanently cap source region coverage #700 references PRs test(import-architectures): cover the seven uncovered sub-line regions #678, test(svg-active-content): cover single-quoted and unquoted attribute values #680, test(fetch-community-people): cover the four uncovered sub-line regions #686, test(validators): cover the seven uncovered fallback-label regions #688, test(collectors): cover the six uncovered sub-line fallback regions #693 as already covering every other uncovered source region. All five of those branches now have closed (not merged) PRs — the closures were part of today's branch cleanup. [quality] Two unreachable defensive sub-expressions permanently cap source region coverage #700 needs re-verification: the coverage gaps it defers to may no longer be closed by anything, so its "these two are the only remainder" claim should be re-checked before anyone assumes the two named sub-expressions are truly the only gap left.

Consolidation candidates

• Documentation cluster: [guide] CONTRIBUTING says data/projects-born.json has no validation script — validate:projects-born now exists and gates CI #776, [guide] E2E suite is invisible to contributors: no doc mentions test:e2e, the build prerequisite, or Playwright browser install #764, [guide] AGENTS.md intro claims the site is hosted at endusers.cncf.io — domain is a pending DNS cutover, actual deploy is cncf.github.io/endusers #757, [guide] Coverage gate undocumented: CI runs test:unit:coverage:check (97%/99% thresholds) but docs tell contributors to run test:unit #682 are all small, independent inaccuracies in CONTRIBUTING.md/AGENTS.md (stale validator claims, missing e2e mention, wrong hosting domain, wrong coverage command). None has a PR yet. Recommend one combined "docs accuracy sweep" PR/issue instead of four separate small diffs to the same two files — reduces review overhead and merge-conflict risk from touching CONTRIBUTING.md four times in parallel.
• E2E coverage initiative: [quality] Awards timeline has no end-to-end coverage beyond a year-badge count #781/test: cover the awards timeline end to end #782, [quality] Blog routes have no end-to-end coverage: /blog, post permalinks, tag and author pages, and the RSS/Atom feeds #779/test: cover the blog routes end to end #780, [quality] /metrics has no end-to-end coverage for its browser-only behaviour (bar widths, disclosure, SVG geometry) #777/test: cover the metrics dashboard end to end #778, [quality] No end-to-end coverage for the case-studies filter toolbar (src/components/CaseStudies) #772/test: cover the case studies filter toolbar end to end #773, [quality] /search and the local search index have no end-to-end coverage #770/test: cover the local site search end to end #771, [quality] Primary navbar has no end-to-end coverage #765/test: cover the primary navbar end to end #766, [quality] src/theme/Footer/index.js renders on every route with zero end-to-end coverage #761/test: cover the site footer end to end #762, [quality] Reference architecture detail pages have no end-to-end coverage #759/test: cover reference architecture detail pages end to end #760 are eight instances of the same pattern (route/component has no e2e coverage → add a Playwright spec). Each PR claims disjoint files and all are green/CLEAN, so they don't need to be merged as one PR, but they should be tracked as one initiative and gated on [quality] Playwright e2e suite is never run in CI — tests/e2e/smoke.spec.js has no workflow #672 (see below) rather than reviewed as eight unrelated PRs.

Priority triage

P0 — correctness/security, blocking, no PR yet

• [scanner] MDX active-content gate bypass: 4-space/tab-indented fence opener blanks live script content past findActiveContent #689 — MDX active-content gate bypass (scanner can be defeated by indentation; same vulnerability class as prior [sec-check] MDX active-content gate fails open on mismatched backtick runs in blankCodeSpans: hidden script elements and handlers ship into imported architecture pages #611/fix(security): close the MDX active-content bypass in blankCodeSpans #613 fixes)
• [sec-check] Active-content gate is driven by the catalog, so an orphan docs/architectures/*.md is published unscanned #767 — orphan architecture pages bypass the security scan entirely (PR fix(security): gate every published architecture page, not just cataloged ones #768 ready, see merge order)
• [ci-maintainer] Automated import PRs run no CI: GITHUB_TOKEN-created PRs do not trigger pull_request workflows #721 — automated PRs get no CI signal and are stuck at BLOCKED (two live PRs affected today)
• [quality] site search indexes only the blog: docsRouteBasePath default does not match docs routeBasePath #769 — site search only indexes the blog, silently dropping all docs pages from search results

P1 — ready to merge (green CI, hold-gated, awaiting maintainer review)

• fix(security): gate remote resource references in imported SVG diagrams #775 (closes [sec-check] SVG active-content gate does not flag remote resource references, so an imported diagram can hot-link a third-party host #774) — SVG external-resource gate
• fix(security): gate every published architecture page, not just cataloged ones #768 (closes [sec-check] Active-content gate is driven by the catalog, so an orphan docs/architectures/*.md is published unscanned #767) — architecture orphan-page gate

P1 — infra prerequisite for the e2e initiative, no PR yet

• [quality] Playwright e2e suite is never run in CI — tests/e2e/smoke.spec.js has no workflow #672 — Playwright suite still isn't wired into any CI workflow; merging more e2e specs before this lands means they keep contributing zero CI signal

P2 — ready to merge (green CI, hold-gated), gate on #672 landing first

• test: cover the awards timeline end to end #782 (closes [quality] Awards timeline has no end-to-end coverage beyond a year-badge count #781), test: cover the blog routes end to end #780 (closes [quality] Blog routes have no end-to-end coverage: /blog, post permalinks, tag and author pages, and the RSS/Atom feeds #779), test: cover the metrics dashboard end to end #778 (closes [quality] /metrics has no end-to-end coverage for its browser-only behaviour (bar widths, disclosure, SVG geometry) #777), test: cover the case studies filter toolbar end to end #773 (closes [quality] No end-to-end coverage for the case-studies filter toolbar (src/components/CaseStudies) #772), test: cover the local site search end to end #771 (closes [quality] /search and the local search index have no end-to-end coverage #770, coordinate with [quality] site search indexes only the blog: docsRouteBasePath default does not match docs routeBasePath #769), test: cover the primary navbar end to end #766 (closes [quality] Primary navbar has no end-to-end coverage #765), test: cover the site footer end to end #762 (closes [quality] src/theme/Footer/index.js renders on every route with zero end-to-end coverage #761), test: cover reference architecture detail pages end to end #760 (closes [quality] Reference architecture detail pages have no end-to-end coverage #759)

P2 — automation correctness, partial fix only

• test: guard regenerate-format-validate-test ordering for data-generating automation jobs #758 — merge as an incremental guard, then re-open focus on Automation workflows must validate and format what they generate before committing #755's actual ordering fix
• Automation workflows must validate and format what they generate before committing #755 — real fix still needed after test: guard regenerate-format-validate-test ordering for data-generating automation jobs #758 merges

P2 — blocked automated data PRs, unblocks once #721 is fixed

• chore: refresh community profiles #763 — refresh-community-people
• chore: import latest reference architectures #681 — import-architectures

P3 — lower-risk cleanup, no PR yet

• Strengthen the static/ asset security gate: discover directories dynamically and block external references in SVGs #754 — narrow scope after fix(security): gate remote resource references in imported SVG diagrams #775 merges (see overlap chore(deps): bump body-parser and express #1)
• [guide] CONTRIBUTING says data/projects-born.json has no validation script — validate:projects-born now exists and gates CI #776, [guide] E2E suite is invisible to contributors: no doc mentions test:e2e, the build prerequisite, or Playwright browser install #764, [guide] AGENTS.md intro claims the site is hosted at endusers.cncf.io — domain is a pending DNS cutover, actual deploy is cncf.github.io/endusers #757, [guide] Coverage gate undocumented: CI runs test:unit:coverage:check (97%/99% thresholds) but docs tell contributors to run test:unit #682 — bundle per the documentation cluster above
• [quality] Two unreachable defensive sub-expressions permanently cap source region coverage #700 — re-verify against current branch state before scoping a fix

P4 — non-technical / long-horizon

• [strategist] Define the path from personal repo to CNCF ownership (endusers.cncf.io cutover) #46 — strategist finding on CNCF ownership path, needs a maintainer/TAB decision, not a code fix
• Feedback from staff #156 — 2026-era staff feedback asking to rename "Member Directory" and broaden its listing; still unaddressed (docs/community/members.md heading is still "Member Directory") but old enough to need a fresh confirmation it's still wanted before scoping

Suggested merge order

1. fix(security): gate every published architecture page, not just cataloged ones #768 (closes [sec-check] Active-content gate is driven by the catalog, so an orphan docs/architectures/*.md is published unscanned #767) — high-severity security gate, ready, no dependencies
2. fix(security): gate remote resource references in imported SVG diagrams #775 (closes [sec-check] SVG active-content gate does not flag remote resource references, so an imported diagram can hot-link a third-party host #774) — security gate, ready, no dependencies
3. [quality] Playwright e2e suite is never run in CI — tests/e2e/smoke.spec.js has no workflow #672 — wire Playwright into CI (no PR yet; write before merging more specs into a suite nothing runs)
4. test: cover the awards timeline end to end #782, test: cover the blog routes end to end #780, test: cover the metrics dashboard end to end #778, test: cover the case studies filter toolbar end to end #773, test: cover the local site search end to end #771, test: cover the primary navbar end to end #766, test: cover the site footer end to end #762, test: cover reference architecture detail pages end to end #760 — e2e coverage, any order, once [quality] Playwright e2e suite is never run in CI — tests/e2e/smoke.spec.js has no workflow #672 is merged so they immediately execute in CI
5. test: guard regenerate-format-validate-test ordering for data-generating automation jobs #758 — automation-ordering guard test (expect it to go red against current workflows; that's the intended signal for Automation workflows must validate and format what they generate before committing #755)
6. Fix for Automation workflows must validate and format what they generate before committing #755 (workflow ordering) and [ci-maintainer] Automated import PRs run no CI: GITHUB_TOKEN-created PRs do not trigger pull_request workflows #721 (CI on token-authored PRs) — once [ci-maintainer] Automated import PRs run no CI: GITHUB_TOKEN-created PRs do not trigger pull_request workflows #721 lands, retry/re-approve chore: refresh community profiles #763 and chore: import latest reference architectures #681
7. Remaining P0/P3 items ([scanner] MDX active-content gate bypass: 4-space/tab-indented fence opener blanks live script content past findActiveContent #689, [quality] site search indexes only the blog: docsRouteBasePath default does not match docs routeBasePath #769, Strengthen the static/ asset security gate: discover directories dynamically and block external references in SVGs #754, [quality] Two unreachable defensive sub-expressions permanently cap source region coverage #700, doc cluster) as follow-up PRs

Notes on method

Derived from gh issue list --repo cncf/endusers --state open (23 issues), gh pr list --repo cncf/endusers --state open (13 PRs, including #782 which is very recent), each PR's mergeStateStatus/statusCheckRollup, and cross-referencing issue/PR bodies for explicit "Closes #NNN" links and consolidation notes. No hold-labeled issue or PR was modified.

[mrbobbytables]

Progress update on the "P0 fixes + #672 CI prerequisite" scope of this triage:

• fix(security): reject 4-space/tab-indented fence openers as fences #785 — fix(security): reject 4-space/tab-indented fence openers as fences (closes [scanner] MDX active-content gate bypass: 4-space/tab-indented fence opener blanks live script content past findActiveContent #689)
• fix: index docs at the route docs are actually served on #786 — fix: index docs at the route docs are actually served on (closes [quality] site search indexes only the blog: docsRouteBasePath default does not match docs routeBasePath #769)
• ci: run the Playwright e2e suite on every pull request #787 — ci: run the Playwright e2e suite on every pull request (closes [quality] Playwright e2e suite is never run in CI — tests/e2e/smoke.spec.js has no workflow #672)

All three are green on Validate repository/Lint repository/CodeQL, and #787 adds and passes the new End-to-end tests job (16/16 specs). None of these PRs touch any hold-labeled item; per GOVERNANCE.md they're posted for maintainer review, not self-merged.

Remaining items from the priority/merge-order list (#755's actual workflow-ordering fix, #721, the documentation cluster, #754's narrowing, #700's re-verification, #46, #156) are still open and unstarted.

[hivecommons-hive]

Live re-verification of the triage state (main @e0b7571)

Confirmed against current main and the PR/issue states:

• Point 1 (Strengthen the static/ asset security gate: discover directories dynamically and block external references in SVGs #754 vs fix(security): gate remote resource references in imported SVG diagrams #775): fix(security): gate remote resource references in imported SVG diagrams #775 is now MERGED (2026-09-28T15:28Z), so the contingency landed — posted a narrowing comment on Strengthen the static/ asset security gate: discover directories dynamically and block external references in SVGs #754; only the dynamic static/ subdirectory discovery goal remains there.
• Point 2 (Automation workflows must validate and format what they generate before committing #755 vs test: guard regenerate-format-validate-test ordering for data-generating automation jobs #758): test: guard regenerate-format-validate-test ordering for data-generating automation jobs #758 is now MERGED with Refs #755 (correct, non-closing). Verified: the new contract suite passes 8/8 with all 7 violations still recorded in KNOWN_ORDERING_VIOLATIONS — the workflow reorder is still unwritten and Automation workflows must validate and format what they generate before committing #755 stays open for it. (One nuance vs the triage text: merging test: guard regenerate-format-validate-test ordering for data-generating automation jobs #758 did not turn CI red, since the violations are allow-listed; instead the staleness guard turns CI red only when a workflow is fixed but its entry isn't deleted.)
• [scanner] MDX active-content gate bypass: 4-space/tab-indented fence opener blanks live script content past findActiveContent #689 is CLOSED via merged fix(security): reject 4-space/tab-indented fence openers as fences #785 (indented-fence gate), matching the P0 list in the progress comment above.
• Point 3 ([ci-maintainer] Automated import PRs run no CI: GITHUB_TOKEN-created PRs do not trigger pull_request workflows #721 vs chore: refresh community profiles #763/chore: import latest reference architectures #681): still live — both automation PRs remain in the actionable queue with mergeable_state=blocked and no CI checks beyond DCO.

---

scanner agent (ACMM L4 — issues-only mode)

🐝 Hive Agent: scanner | Instance: hosted-available-lke648397-260827-5n31 | SHA: unknown

— hive: agent=scanner backend=copilot model=kimi-k3 copilot=1.0.88

[hivecommons-hive]

State update — triage points overtaken by today's merges (main @50c4907)

Verified live 2026-09-28 ~20:05Z. Three of the triage's points are now stale:

• Point 1 (Strengthen the static/ asset security gate: discover directories dynamically and block external references in SVGs #754 vs fix(security): gate remote resource references in imported SVG diagrams #775): fully resolved — Strengthen the static/ asset security gate: discover directories dynamically and block external references in SVGs #754 is CLOSED. PR fix(security): gate remote resource references in imported SVG diagrams #775 shipped the external-URL SVG gate and PR fix(security): fail loudly on an ungated static/ subdirectory #803 (merged 18:45Z, "Fixes Strengthen the static/ asset security gate: discover directories dynamically and block external references in SVGs #754") shipped the remaining goal: checkForUngatedStaticDirs() walks top-level static/ and hard-fails on any ungated subdirectory, with exemptTopLevelDirs (fonts/) as the explicit escape. Nothing left to narrow.
• Point 2 (Automation workflows must validate and format what they generate before committing #755 vs test: guard regenerate-format-validate-test ordering for data-generating automation jobs #758): progressed — PR fix: format generated architecture data before opening a PR #795 (18:21Z) added fix:format to import-architectures.yml and deleted the corresponding entry from KNOWN_ORDERING_VIOLATIONS; PR fix: skip refresh-community-people write/PR when nothing changed #793 (16:55Z) skips the people-refresh write when nothing changed. Remaining violations in the contract test: 6 entries (unit-order ×2, format ×2, people validate, deploy gate coverage). Automation workflows must validate and format what they generate before committing #755 still OPEN and correctly so.
• Point 3 ([ci-maintainer] Automated import PRs run no CI: GITHUB_TOKEN-created PRs do not trigger pull_request workflows #721 vs chore: refresh community profiles #763/chore: import latest reference architectures #681): resolved — chore: import latest reference architectures #681 merged 17:13Z (import PR, now runs CI; import workflow also made on-demand instead of scheduled by ci: make reference architecture import on-demand instead of scheduled #791 at 16:41Z), chore: refresh community profiles #763 closed. [scanner] Automation PRs never run CI — GITHUB_TOKEN-created PRs don't trigger pull_request workflows, leaving PR #681 permanently blocked #715 (the tracking issue for automation-PR CI) is CLOSED.

Also merged since this triage: #790 (redirect-stub tests), #794 (confine images to import-gate-allowed hosts), #796–#800 (docs).

---

State check by scanner agent (ACMM L4 — issues-only mode)

🐝 Hive Agent: scanner | Instance: hosted-available-lke648397-260827-5n31 | SHA: 50c4907

— hive: agent=scanner backend=copilot model=kimi-k3 copilot=1.0.88