Skip to content

test(bundle): drive /remove-help, the built-in /lifecycle defaults and the no-config failure through dist/index.js - #246

Merged
github-actions[bot] merged 2 commits into
mainfrom
quality/test-bundle-fixed-prefixed-labels
Oct 7, 2026
Merged

github-actions[bot] merged 2 commits into
mainfrom
quality/test-bundle-fixed-prefixed-labels

Conversation

@hivecommons-hive

@hivecommons-hive hivecommons-hive Bot commented Sep 30, 2026 •

Copy link
Copy Markdown
Contributor

Test Improvement

Adds __tests__/bundle/labelCommands.test.ts with the three label-command paths dist/index.js is not otherwise driven through:

  • /remove-help → reads the issue, deletes Help Wanted and good first issue (case-insensitive match), no POST, then the post-command sweep's configuration reads
  • /lifecycle stale with a .prowlabels.yaml that has no lifecycle key → Prow's built-in defaults apply, exclusively: lifecycle/frozen is deleted, then { labels: ['lifecycle/stale'] } is posted
  • /lifecycle stale with no configuration file in any tier → exit 1, error contains no prow configuration found, the ten configuration reads and nothing else (the failure docs/labeling.md promises)

comment/repo/token/configReads/helpersFor come from the shared __tests__/bundle/helpers.ts. The other 11 cases of the first revision (/good-first-issue, /remove-good-first-issue, /stage, /status, /priority, the remaining /lifecycle variants) were dropped on review: their lookup tables are unit-tested at help.test.ts:78–133, lifecycle.test.ts:69–120 and priority.test.ts, and bundle.test.ts already exercises the add/remove/exclusive paths via /help, /kind, /remove-kind and /level.

Verification on main @ a270568: npx eslint, npx tsc --noEmit, npx vitest run __tests__/bundle/labelCommands.test.ts — 3 pass.

Related Issue

Closes #245


Filed by quality agent (hold-gated mode). Human review required.

@hivecommons-hive
hivecommons-hive Bot requested a review from jpmcb as a code owner September 30, 2026 12:50
@hivecommons-hive hivecommons-hive Bot added the hold Indicates that a PR should not merge because someone has issued a /hold command. label Sep 30, 2026
@hivecommons-hive

Copy link
Copy Markdown
Contributor Author

Important

Held for human review by the hive's ACMM level gate.

This PR was opened by the "quality" agent while Hive policy required a human checkpoint for that agent. Non-outreach agents are held at ACMM L3–L5; the outreach agent is always held because it publishes project-facing communication.

Hive will automatically remove the hold label once current policy no longer requires a level hold for "quality". If this is an outreach PR, a human must review it and remove the label.

@jeefy jeefy left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

These are 14 variations on two lookup tables that are already unit-tested (help.test.ts:78–133, lifecycle.test.ts:69–120, priority.test.ts). The bundle tests already exercise the same add/remove/exclusive paths via /help, /kind, /remove-kind and /level.

  1. Trim to the three cases dist/ doesn't yet reach: /remove-help, /lifecycle stale from the built-in defaults, and the no-config failure that docs/labeling.md promises.
  2. Use a shared config-read list, comment() and repoLabels() instead of copying them.

@hivecommons-hive
hivecommons-hive Bot force-pushed the quality/test-bundle-fixed-prefixed-labels branch from 49ffed3 to e429462 Compare October 3, 2026 05:20
@hivecommons-hive hivecommons-hive Bot changed the title test(bundle): drive the fixed-label (/good-first-issue, /remove-help) and built-in prefixed (/lifecycle, /stage, /status, /priority) commands through dist/index.js test(bundle): drive /remove-help, the built-in /lifecycle defaults and the no-config failure through dist/index.js Oct 3, 2026
@hivecommons-hive hivecommons-hive Bot added agent/quality Created by Hive for agent-filed issue provenance hive/hosted-available-lke648397-260827-5q9t Created by Hive for agent-filed issue provenance labels Oct 3, 2026
@hivecommons-hive

Copy link
Copy Markdown
Contributor Author

Addressed both: trimmed to the three cases (/remove-help, /lifecycle stale from the built-in defaults, the no-config failure) and switched to the shared comment/configReads/helpersFor from helpers.ts (#273) instead of local copies. 326 → 73 lines. Rebased on main @ a270568.


🐝 Hive Agent: quality | Instance: hosted-available-lke648397-260827-5q9t | SHA: e429462

— hive: agent=quality backend=copilot model=claude-fable-5.1 copilot=1.0.88

@jeefy

jeefy commented Oct 3, 2026

Copy link
Copy Markdown
Member

#273 is merged: __tests__/bundle/helpers.ts now exports repo, token, comment(), configReads(), ownersReads, ownersProbe, queueRead, membershipReads(), and via helpersFor(() => gh): calls(), expectRequests(), expectCommandThenConfig() and routeOwners(). Please rebase on main and import these instead of declaring local copies.

repoLabels() isn't in it yet (only one merged suite used it); move it into helpers.ts in this PR and import it from bundle.test.ts too, rather than copying.

quality added 2 commits October 3, 2026 15:50
…d the no-config failure through dist/index.js

Signed-off-by: quality <quality@hive.kubestellar.io>
…rom bundle.test.ts

Signed-off-by: quality <quality@hive.kubestellar.io>
@hivecommons-hive
hivecommons-hive Bot force-pushed the quality/test-bundle-fixed-prefixed-labels branch from e429462 to cc65969 Compare October 3, 2026 19:51
@hivecommons-hive

Copy link
Copy Markdown
Contributor Author

Rebased on main @ ec76a3b with #273's helpers in place. repoLabels() now lives in __tests__/bundle/helpers.ts; bundle.test.ts imports it instead of its local copy, and labelCommands.test.ts uses it for the GET /labels route too. The suite's other helpers (comment, configReads, helpersFor, repo, token) were already imported. npx eslint __tests__/bundle clean, npx tsc --noEmit clean, npx vitest run __tests__/bundle/labelCommands.test.ts __tests__/bundle/bundle.test.ts → 103 pass.

— hive: agent=quality backend=copilot model=claude-fable-5.1 copilot=1.0.88

This was referenced Oct 4, 2026

@jeefy jeefy left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Your asks are addressed and it passes on main. Optional: labelsRead (L11) duplicates bundle.test.ts:22, so it could be exported from helpers.ts.

@jeefy

jeefy commented Oct 7, 2026

Copy link
Copy Markdown
Member

/kind cleanup
/lgtm
/approve
/hold cancel

@github-actions github-actions Bot added kind/cleanup Categorizes issue or PR as related to cleaning up code, process, or technical debt. and removed hold Indicates that a PR should not merge because someone has issued a /hold command. labels Oct 7, 2026
@github-actions github-actions Bot added lgtm "Looks good to me", indicates that a PR is ready to be merged. and removed needs-kind labels Oct 7, 2026
@hivecommons-hive

Copy link
Copy Markdown
Contributor Author

🔒 Hold-gate integrity: branch changed while hold-gated — fresh review required

This PR's branch moved while it sat hold-gated: the head recorded when the hold was applied was 49ffed37469f, but the branch now sits at cc65969f65ba. The diff a reviewer saw under the hold is no longer the diff that would merge, so auto-merge is blocked and the hold label has been re-applied.

Commits not present in the hold-time snapshot (2):

  • 53deae8d3df8 by quality — test(bundle): drive /remove-help, the built-in /lifecycle defaults and the no-config failure through dist/index.js
  • cc65969f65ba by quality — test(bundle): move repoLabels into the shared helpers and import it from bundle.test.ts

A human should review the FULL diff at the current head — a rebase or force-push renames every commit, so everything above needs eyes even if it looks familiar. Removing the hold label after that review is the fresh approval: the guard has re-pinned its snapshot to the current head, so a clean lift re-opens the merge lanes.

@jeefy

jeefy commented Oct 7, 2026

Copy link
Copy Markdown
Member

/lgtm

@github-actions
github-actions Bot merged commit ff1e83d into main Oct 7, 2026
10 of 11 checks passed
jeefy added a commit to jeefy/prow-github-actions that referenced this pull request Oct 7, 2026
…remove-help and /remove-good-first-issue

The fixed label commands now read the configuration for
authorization.labels before writing, and the needs-* re-check that
follows finds it memoized. The two bundle cases main gained in cncf#246 and
cncf#300 pinned the configuration reads after the command; they now pin
them ahead of the unchanged command sequence, as bundle.test.ts does
for /help.

Signed-off-by: Jeffrey Sica <me@jeefy.dev>
jeefy added a commit that referenced this pull request Oct 7, 2026
…view commands (#367)

* feat(auth): opt-in authorization policy for label, hold, close and review commands

A new top-level `authorization` section in prow.yaml decides who may run the
label commands (`labels`), /hold (`hold`), /close and /reopen (`close`), and,
on repositories without OWNERS files, /lgtm, /approve, /retest, /test and
/ok-to-test (`review`). Policies are anyone | collaborators | members |
trusted; `trusted` adds the `users` list and the root OWNERS reviewers and
approvers. `review` accepts only members | trusted.

Defaults reproduce today's gates exactly (labels/hold anyone, close
collaborators, review members, users []). Per key the repository tier wins
over the organization tier, except `users`, which is unioned
case-insensitively.

`anyone` makes no API call. /close, /reopen and the review fallback keep
their existing checks and request order and read the configuration only
when those checks refuse, which is exact because every policy admits
collaborators (close) and members/collaborators (review). /help and
/good-first-issue now read the configuration before writing, as the
prefixed label commands already did.

Signed-off-by: Jeffrey Sica <me@jeefy.dev>

* docs: document the authorization section

Adds the `### authorization` section to docs/configuration.md (fields,
policies, the `users` union, review only applying without OWNERS files,
the OWNERS side-effect warning and the missing_comment note), the policy
column and refusal behaviour in docs/commands.md, a parity row in
docs/prow-for-your-org.md and a commented-out block in templates/prow.yaml.

Signed-off-by: Jeffrey Sica <me@jeefy.dev>

* fix(auth): fail closed when the authorization config cannot be loaded

Security review follow-ups for the authorization section:

- the review fallback of assertAuthorizedByOwnersOrMembership logs a
  warning and falls back to the default `members` policy when the
  configuration cannot be loaded, so the refusal comment carries the
  usual `members` message and never the configuration error;
- closePolicyAllows logs a warning and refuses when the configuration
  cannot be loaded, keeping a refused /close or /reopen silent;
- policyAllows refuses an empty login before anything else;
- authorization.users entries are trimmed and must be GitHub logins
  (optionally with a `[bot]` suffix); a leading `@`, inner spaces,
  underscores or teams are rejected;
- docs: the org tier supplies defaults, not floors (use rulesets for
  enforcement), the `config` input may point at a ref or URL, review
  applies to issues without a root OWNERS file, and the refusal
  behaviour when the configuration cannot be loaded.

Signed-off-by: Jeffrey Sica <me@jeefy.dev>

* test(bundle): expect the authorization.labels config reads ahead of /remove-help and /remove-good-first-issue

The fixed label commands now read the configuration for
authorization.labels before writing, and the needs-* re-check that
follows finds it memoized. The two bundle cases main gained in #246 and
#300 pinned the configuration reads after the command; they now pin
them ahead of the unchanged command sequence, as bundle.test.ts does
for /help.

Signed-off-by: Jeffrey Sica <me@jeefy.dev>

---------

Signed-off-by: Jeffrey Sica <me@jeefy.dev>
@mrbobbytables
mrbobbytables deleted the quality/test-bundle-fixed-prefixed-labels branch October 9, 2026 17:32
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

agent/quality Created by Hive for agent-filed issue provenance hive/hosted-available-lke648397-260827-5q9t Created by Hive for agent-filed issue provenance kind/cleanup Categorizes issue or PR as related to cleaning up code, process, or technical debt. lgtm "Looks good to me", indicates that a PR is ready to be merged.

Projects

None yet

1 participant