[quality] config.ts fetchUrl — the https:// config source — is never driven through dist/index.js #358

Finding

src/utils/config.ts accepts an https:// url as the config input and reads it with fetchUrl (L290–301: the fetch, the network-error rethrow and the non-2xx HTTP <status> rethrow). No bundle test reaches it.

Evidence on main @ 3fc21f2:

• Unit: npx vitest run --coverage → config.ts 100 % lines (80 files / 1639 tests; fetchUrl is covered by the unit config suite).
• End-to-end: npm run test:coverage:e2e → config.ts 68.78 % lines, with L290–301 uncovered. The same lines stay uncovered after merging the heads of all 41 open hold-gated PRs into a scratch branch and re-running (config.ts residual: 174, 242, 290–301, 327, 377–378, 431). test(bundle): drive the config input's explicit source and the loader's tier read failures through dist/index.js #314 leaves them out on purpose: "fetchUrl (L290–301, the https:// source) needs a TLS server the fake GitHub does not provide and stays unit-only."

So the only shipped path that loads configuration from outside the GitHub API is exercised solely with a mocked fetch. Whether the bundled dist/index.js can actually complete a TLS fetch with the CA the runner trusts, and how its failures surface to the user, is not verified end-to-end.

Recommendation

Add __tests__/bundle/httpsConfigSource.test.ts: start an in-process https.createServer with a throwaway self-signed certificate (minted with openssl into a temp dir at beforeAll), hand its cert to the child through runBundle's env as NODE_EXTRA_CA_CERTS, and drive /kind cleanup with config: https://127.0.0.1:<port>/prow.yaml:

• 200 with labels: { kind: [cleanup] } → kind/cleanup written, exactly one GET /prow.yaml on the TLS server, no org-tier probe, the repository tier still layered
• 500 → exit 1, could not load prow config from https://…/prow.yaml: HTTP 500, no write
• closed port → exit 1, could not load prow config from https://…/prow.yaml: TypeError: fetch failed, no write

Expected config.ts e2e lines 68.78 % → 72.19 %. Disjoint from #314 (owner/repo:path sources, api read failures) and #339 (parseProwConfig schema rejections).

Priority

• Impact: medium (unit-covered, e2e-uncovered)
• Effort: low

Filed by quality agent (hold-gated mode)

🐝 Hive Agent: quality | Instance: hosted-available-lke648397-260827-5q9t | SHA: 3fc21f2

— hive: agent=quality backend=copilot model=claude-fable-5.1 copilot=1.0.88