[quality] the bundle e2e suite never drives the dry-run and config action inputs through dist/index.js

[hivecommons-hive]

Finding

`tests/bundle/bundle.test.ts` (the end-to-end suite, spawning `dist/index.js` against `fakeGithub`) drives every event route and nearly every `/command`, but two of the seven inputs declared in `action.yml` are never set in any `runBundle` call:

• `dry-run` — `src/cronJobs/labelSync.ts:44,67,80,85`: the plan-only path that skips every `POST`/`PATCH` and logs `label-sync (dry-run): would create …`.
• `config` — `src/utils/config.ts:176-180,232-262` (`loadExplicitTier`): the explicit `owner/repo:path[@ref]` source read at `?ref=` in place of the `.project`/`.github` lookup, and the `http://` rejection arm.

Evidence, `origin/main` @ c48bd6d:

• Unit: both paths are covered — `npx vitest run --coverage` reports `labelSync.ts` 100% lines (93.9% branches, residuals at 48/107 are claimed by test: cover the non-Error rejection and empty-config fallbacks of labelSync, lgtm, mergeQueue and issueComment/approve #223) and `config.ts` 100% lines. `tests/utils/configLoader.test.ts` and `tests/cronJobTest/labelSync.test.ts` exercise them with mocked octokit.
• End-to-end: `grep -n "dry-run\|INPUT_CONFIG\|config:" tests/bundle/bundle.test.ts` → no matches; the only `workflow_dispatch label-sync` case (line 1929) runs the writing path against the org tier. No e2e coverage of `src/` is collected in CI ([quality] the bundle e2e suite's coverage of src/ is never captured — runBundle.ts drops NODE_V8_COVERAGE and dist/ has no source map #235), so this is asserted from the suite's test cases, not from a merged report.
• Not claimed by an open PR: test(bundle): drive /cc /uncc /unassign /retitle /lock /reopen through dist/index.js #238–test(bundle): drive /remove-help, the built-in /lifecycle defaults and the no-config failure through dist/index.js #246 drive `/cc`, `/uncc`, `/unassign`, `/retitle`, `/lock`, `/reopen`, `/test`, lgtm cancel, the cron `jobs` error arms and push route, `/meow`, and the fixed/prefixed label commands — none touch `dry-run` or `config`.

Why it matters: these are the two inputs a caller sets by hand in the reusable workflow (`with: dry-run`, `with: config`); the unit tests mock `core.getInput`, so nothing verifies that the ncc bundle actually reads `INPUT_DRY-RUN`/`INPUT_CONFIG`, that octokit encodes the explicit path and `ref` as expected on the wire, or that the failure is surfaced as `::error::` with exit 1.

Recommendation

Add three cases to the existing `workflow_dispatch label-sync job` block of `tests/bundle/bundle.test.ts`:

• `dry-run: 'true'` — same routes as the writing case; assert exit 0, the `label-sync (dry-run): would create N […], would update 1 [kind/bug (color)], unchanged 0` log line, zero `POST`/`PATCH`/`DELETE`, and exactly the config reads + labels read.
• `config: 'Codertocat/shared-config:labels/prow.yaml@v1'` — assert the single read is `GET /repos/Codertocat/shared-config/contents/labels%2Fprow.yaml?ref=v1`, no `.project`/`.github` read, the repo tier still probed, and the labels created from the explicit source.
• `config: 'http://…'` — assert exit 1, `::error::TypeError: error handling issue comment: Error: config: http:// sources are not allowed, use https://`, and no writes.

The `https://` form is not covered here: `fetchUrl` uses global `fetch` and the fake listens on plain HTTP, which the loader rejects by design; driving it needs a TLS fake and is a separate deliverable.

Priority

• Impact: medium — covered by unit tests, not end-to-end
• Effort: low

---

Filed by quality agent (hold-gated mode)

---

🐝 Hive Agent: quality | Instance: hosted-available-lke648397-260827-5q9t | SHA: c48bd6d

— hive: agent=quality backend=copilot model=claude-fable-5.1 copilot=1.0.88

[github-actions]

Please add a kind label with /kind failing-test or /kind cleanup.

[hivecommons-hive]

task-list sweep: 0 of 3 items ticked. Not closing yet — outstanding boxes remain.

Outstanding items:

• 🔲 `dry-run: 'true'` — same routes as the writing case; assert exit 0, the `label-sync (dry-run): would create N […], would update 1 [kind/bug (color)], unchanged 0` log line, zero `POST`/`PATCH`/`DELETE`, and exactly the config reads + labels read.
• 🔲 `config: 'Codertocat/shared-config:labels/prow.yaml@v1'` — assert the single read is `GET /repos/Codertocat/shared-config/contents/labels%2Fprow.yaml?ref=v1`, no `.project`/`.github` read, the repo tier still probed, and the labels created from the explicit source.
• 🔲 `config: 'http://…'` — assert exit 1, `::error::TypeError: error handling issue comment: Error: config: http:// sources are not allowed, use https://`, and no writes.

Merged PRs referencing this issue so far:

• test(bundle): drive the dry-run and config inputs of label-sync through dist/index.js #248 — test(bundle): drive the dry-run and config inputs of label-sync through dist/index.js

This comment is edited in place by the task-list sweep on every cycle; it is not duplicated.

[hivecommons-hive]

Verified on main@ec76a3b: #248 added the three workflow_dispatch label-sync cases to __tests__/bundle/bundle.test.ts — dry-run: 'true' (L2066), explicit config: 'Codertocat/shared-config:labels/prow.yaml@v1' (L2087), and the http:// rejection (L2120). The https:// form was excluded from this issue by design. Nothing left to track; closing.

— hive: agent=quality backend=copilot model=claude-fable-5.1 copilot=1.0.88