test(bundle): drive root-OWNERS authorization on an issue and the OWNERS-based /lgtm refusal through dist/index.js

[hivecommons-hive]

Test Improvement

Adds __tests__/bundle/ownersAuth.test.ts (new file only; imports comment, helpersFor, ownersProbe, ownersReads, queueRead, repo, token from ./helpers) with three /lgtm cases driven through the committed dist/index.js against fakeGithub — the OWNERS arms of src/utils/auth.ts that no bundle test reached:

1. issue, root OWNERS lists the commenter as reviewer → GET …/contents/OWNERS (200, base64) → GET …/labels → POST …/issues/1/labels {labels:['lgtm']}; no /orgs/…/members or /collaborators read; then the post-command config reads (assertRootOwner + retrieveOwnersFile, L271–290 / L338–364).
2. issue, root OWNERS does not list the commenter → exit 1, one refusal comment Cannot apply the lgtm label because Error: Codertocat is not included in the reviewers role in the OWNERS file, no label write, no membership fallback.
3. pull request, OWNERS + sdk/OWNERS cover sdk/file.go, commenter in neither → exit 1, … stranger is not a reviewer or approver for any changed file, no contents/OWNERS read, no membership read; then the config reads and tide's gate (L321–322).

Every bundle /lgtm so far was either by a listed reviewer on an OWNERS repository or went through the membership fallback with contents/OWNERS answering 404; no bundle test sent /lgtm to a plain issue at all.

Measured with npm run test:coverage:e2e on main @ ec76a3b: src/utils/auth.ts e2e lines 63.1 % → 79.61 % (branches 53.12 % → 70.31 %). The remaining unreached lines in the file are throw/catch arms the unit suite (__tests__/utils/auth.test.ts) already pins; they are not repeated here.

Verification: npx eslint __tests__/bundle/ownersAuth.test.ts clean, npx tsc --noEmit clean, npx vitest run __tests__/bundle/ownersAuth.test.ts → 3 pass.

Disjoint from the open hold-gated PRs: #230 (vitest.config.mjs), #242 (cronJobsInput.test.ts), #244 (meow.test.ts), #246 (labelCommands.test.ts, helpers.ts).

Related Issue

Closes #282

---

Filed by quality agent (hold-gated mode). Human review required.

— hive: agent=quality backend=copilot model=claude-fable-5.1 copilot=1.0.88

[hivecommons-hive]

Important

Held for human review by the hive's ACMM level gate.

This PR was opened by the "quality" agent while Hive policy required a human checkpoint for that agent. Non-outreach agents are held at ACMM L3–L5; the outreach agent is always held because it publishes project-facing communication.

Hive will keep the hold label until a human removes it. Operators can make a deliberate one-off release during an ACMM level change with release_level_holds=true, but level changes never release this hold automatically.

[hivecommons-hive]

/kind cleanup

— hive: agent=quality backend=copilot model=claude-fable-5.1 copilot=1.0.88

[jeefy]

All three cases add coverage, but the pull-request case is flaky: it failed 5 of 12 local runs.

• ownersAuth.test.ts:86–90 expects the two OWNERS reads in a fixed order, but the code fetches them concurrently. Put both reads in the any-order argument ([...ownersReads, blobOWNERS, blobSdkOWNERS]) and leave only [commentPost] in the ordered list.
• Minor: :68 and :81 check the full comment text, including the because Error: … wording that lgtm.ts:127 happens to produce. Check only the reason.

[hivecommons-hive]

Addressed both: the two OWNERS blob reads are now in the any-order argument ([...ownersReads, blobOWNERS, blobSdkOWNERS]) with only [commentPost] ordered, and both comment assertions check the reason fragment rather than the full because Error: … text. Merged main too (it brings #287's meow network fix, which is what build-test was failing on).

---

🐝 Hive Agent: quality | Instance: hosted-available-lke648397-260827-5q9t | SHA: unknown

— hive: agent=quality backend=copilot model=claude-fable-5.1

[hivecommons-hive]

Addressed in ec40611: the two OWNERS blob reads are now in the any-order argument ([...ownersReads, blobOWNERS, blobSdkOWNERS]) with only [commentPost] ordered, and the two comment checks look at the refusal reason only, not the because Error: … wording.

CI is green on the new head.

---

🐝 Hive Agent: quality | Instance: hosted-available-lke648397-260827-5q9t | SHA: 1f7d33c

— hive: agent=quality backend=copilot model=claude-fable-5.1 copilot=1.0.88

[jeefy]

Asks addressed; verified on current main (aa6a0f8) together with the other approved PRs.

[jeefy]

/kind cleanup
/lgtm
/approve
/hold cancel