Repository navigation
test(bundle): drive /remove-help, the built-in /lifecycle defaults and the no-config failure through dist/index.js - #246
Conversation
|
Important Held for human review by the hive's ACMM level gate. This PR was opened by the "quality" agent while Hive policy required a human checkpoint for that agent. Non-outreach agents are held at ACMM L3–L5; the Hive will automatically remove the |
jeefy
left a comment
There was a problem hiding this comment.
These are 14 variations on two lookup tables that are already unit-tested (help.test.ts:78–133, lifecycle.test.ts:69–120, priority.test.ts). The bundle tests already exercise the same add/remove/exclusive paths via /help, /kind, /remove-kind and /level.
- Trim to the three cases
dist/doesn't yet reach:/remove-help,/lifecycle stalefrom the built-in defaults, and the no-config failure that docs/labeling.md promises. - Use a shared config-read list,
comment()andrepoLabels()instead of copying them.
49ffed3 to
e429462
Compare
|
Addressed both: trimmed to the three cases ( 🐝 Hive Agent: — hive: agent=quality backend=copilot model=claude-fable-5.1 copilot=1.0.88 |
|
#273 is merged:
|
…d the no-config failure through dist/index.js Signed-off-by: quality <quality@hive.kubestellar.io>
…rom bundle.test.ts Signed-off-by: quality <quality@hive.kubestellar.io>
e429462 to
cc65969
Compare
|
Rebased on — hive: agent=quality backend=copilot model=claude-fable-5.1 copilot=1.0.88 |
jeefy
left a comment
There was a problem hiding this comment.
Your asks are addressed and it passes on main. Optional: labelsRead (L11) duplicates bundle.test.ts:22, so it could be exported from helpers.ts.
|
/kind cleanup |
🔒 Hold-gate integrity: branch changed while hold-gated — fresh review requiredThis PR's branch moved while it sat hold-gated: the head recorded when the hold was applied was Commits not present in the hold-time snapshot (2):
A human should review the FULL diff at the current head — a rebase or force-push renames every commit, so everything above needs eyes even if it looks familiar. Removing the hold label after that review is the fresh approval: the guard has re-pinned its snapshot to the current head, so a clean lift re-opens the merge lanes. |
|
/lgtm |
…remove-help and /remove-good-first-issue The fixed label commands now read the configuration for authorization.labels before writing, and the needs-* re-check that follows finds it memoized. The two bundle cases main gained in cncf#246 and cncf#300 pinned the configuration reads after the command; they now pin them ahead of the unchanged command sequence, as bundle.test.ts does for /help. Signed-off-by: Jeffrey Sica <me@jeefy.dev>
…view commands (#367) * feat(auth): opt-in authorization policy for label, hold, close and review commands A new top-level `authorization` section in prow.yaml decides who may run the label commands (`labels`), /hold (`hold`), /close and /reopen (`close`), and, on repositories without OWNERS files, /lgtm, /approve, /retest, /test and /ok-to-test (`review`). Policies are anyone | collaborators | members | trusted; `trusted` adds the `users` list and the root OWNERS reviewers and approvers. `review` accepts only members | trusted. Defaults reproduce today's gates exactly (labels/hold anyone, close collaborators, review members, users []). Per key the repository tier wins over the organization tier, except `users`, which is unioned case-insensitively. `anyone` makes no API call. /close, /reopen and the review fallback keep their existing checks and request order and read the configuration only when those checks refuse, which is exact because every policy admits collaborators (close) and members/collaborators (review). /help and /good-first-issue now read the configuration before writing, as the prefixed label commands already did. Signed-off-by: Jeffrey Sica <me@jeefy.dev> * docs: document the authorization section Adds the `### authorization` section to docs/configuration.md (fields, policies, the `users` union, review only applying without OWNERS files, the OWNERS side-effect warning and the missing_comment note), the policy column and refusal behaviour in docs/commands.md, a parity row in docs/prow-for-your-org.md and a commented-out block in templates/prow.yaml. Signed-off-by: Jeffrey Sica <me@jeefy.dev> * fix(auth): fail closed when the authorization config cannot be loaded Security review follow-ups for the authorization section: - the review fallback of assertAuthorizedByOwnersOrMembership logs a warning and falls back to the default `members` policy when the configuration cannot be loaded, so the refusal comment carries the usual `members` message and never the configuration error; - closePolicyAllows logs a warning and refuses when the configuration cannot be loaded, keeping a refused /close or /reopen silent; - policyAllows refuses an empty login before anything else; - authorization.users entries are trimmed and must be GitHub logins (optionally with a `[bot]` suffix); a leading `@`, inner spaces, underscores or teams are rejected; - docs: the org tier supplies defaults, not floors (use rulesets for enforcement), the `config` input may point at a ref or URL, review applies to issues without a root OWNERS file, and the refusal behaviour when the configuration cannot be loaded. Signed-off-by: Jeffrey Sica <me@jeefy.dev> * test(bundle): expect the authorization.labels config reads ahead of /remove-help and /remove-good-first-issue The fixed label commands now read the configuration for authorization.labels before writing, and the needs-* re-check that follows finds it memoized. The two bundle cases main gained in #246 and #300 pinned the configuration reads after the command; they now pin them ahead of the unchanged command sequence, as bundle.test.ts does for /help. Signed-off-by: Jeffrey Sica <me@jeefy.dev> --------- Signed-off-by: Jeffrey Sica <me@jeefy.dev>
Test Improvement
Adds
__tests__/bundle/labelCommands.test.tswith the three label-command pathsdist/index.jsis not otherwise driven through:/remove-help→ reads the issue, deletesHelp Wantedandgood first issue(case-insensitive match), noPOST, then the post-command sweep's configuration reads/lifecycle stalewith a.prowlabels.yamlthat has nolifecyclekey → Prow's built-in defaults apply, exclusively:lifecycle/frozenis deleted, then{ labels: ['lifecycle/stale'] }is posted/lifecycle stalewith no configuration file in any tier → exit 1, error containsno prow configuration found, the ten configuration reads and nothing else (the failuredocs/labeling.mdpromises)comment/repo/token/configReads/helpersForcome from the shared__tests__/bundle/helpers.ts. The other 11 cases of the first revision (/good-first-issue,/remove-good-first-issue,/stage,/status,/priority, the remaining/lifecyclevariants) were dropped on review: their lookup tables are unit-tested athelp.test.ts:78–133,lifecycle.test.ts:69–120andpriority.test.ts, andbundle.test.tsalready exercises the add/remove/exclusive paths via/help,/kind,/remove-kindand/level.Verification on
main@ a270568:npx eslint,npx tsc --noEmit,npx vitest run __tests__/bundle/labelCommands.test.ts— 3 pass.Related Issue
Closes #245
Filed by quality agent (hold-gated mode). Human review required.