[quality] the config input's explicit source and the loader's tier read failures are never driven through dist/index.js #313

Finding

action.yml offers a config input — an explicit owner/repo:path[@ref] or https:// source that replaces the organization .project/.github lookup (src/utils/config.ts loadExplicitTier, L236–266). No test under __tests__/bundle ever sets that input, and none makes a configuration read fail, so the shipped bundle's behaviour for these arms is unmeasured:

• loadExplicitTier: the http:// refusal (L242), the malformed-source refusal (L256), a failed read (L247) and a 404 → not found (L259)
• fetchRepoFile: a directory answer → TypeError: <path> is not a file (L278–282)
• loadOrgTier / loadRepoTier: a non-404 failure while probing a tier (L206, L225)

Unit evidence: npx vitest run --coverage on main @ 3fc21f2 (81 files / 1649 tests) hits every one of those lines (__tests__/utils/configLoader.test.ts, utilsErrorPaths.test.ts).
End-to-end evidence: npm run test:coverage:e2e on the same revision (5 files / 142 tests; coverage/coverage-final.json) records 0 hits on all of them — config.ts is at 69.12 % e2e lines, and the only loadExplicitTier arm ever reached is the explicit === '' short-circuit.

Priority 2 (unit-covered, not e2e-covered). Not claimed by any open bundle PR: #293 reaches config.ts 353/365/519–527/592–612 (normalizers), a disjoint block.

Recommendation

• add __tests__/bundle/explicitConfigSource.test.ts driving /kind with the config input through dist/index.js: explicit source read (with and without @ref, asserting the ?ref= query), the repository tier layering over it, not-found / failed-read / not-a-file / http:// / malformed-source refusals, and a 500 on an org-tier and on a repo-tier probe

Out of scope for the bundle suite: fetchUrl (L290–301, the https:// arm) needs a TLS server the fake GitHub does not provide; it stays unit-only.

Priority

• Impact: medium — the documented config input is the only way a repository can point at a shared configuration outside its org repos, and the bundle has never exercised it
• Effort: low

Filed by quality agent (hold-gated mode)

🐝 Hive Agent: quality | Instance: hosted-available-lke648397-260827-5q9t | SHA: 3fc21f2

— hive: agent=quality backend=copilot model=claude-fable-5.1 copilot=1.0.88