test(bundle): drive the approve.github_review refusals, short-circuits and failures through dist/index.js

[hivecommons-hive]

Test Improvement

Adds __tests__/bundle/approveReview.test.ts, which drives /approve and /approve cancel through the committed dist/index.js with approve.github_review: true against the fake GitHub and routes POST …/pulls/1/reviews, PUT …/reviews/71/dismissals and GET /user to the answers src/plugins/approveReview.ts has to handle. Nine cases, each a distinct path the e2e suite did not reach:

GitHub's answer	expected
422 GitHub Actions is not permitted to approve pull requests.	::warning:: with the "Allow GitHub Actions to create and approve pull requests" hint, exit 0, approved still written
any other 403	::warning:: asking for pull-requests: write, exit 0
422 Can not approve your own pull request	::warning:: naming the author, exit 0
GET /user = the PR author	warning, no POST …/reviews at all
any other error (500)	::error:: could not submit the approval review, exit 1, label written first
draft PR	no review, ::debug:: says so
own marked review already on the head	no review, no dismissal
/approve cancel, dismissal refused (403)	::error:: could not dismiss the approval review 71, exit 1, label removed
GET /user 500	::error:: could not identify the token for approve.github_review, exit 1, nothing written

The happy path and the plain /approve cancel dismissal already live in bundle.test.ts and are not duplicated. Imports repo, token and routeOwners from ./helpers; helpers.ts itself is untouched so this does not collide with #246's move of repoLabels (the one-line GET /labels route is inline here and can switch to the shared helper once #246 lands).

Measured with npm run test:coverage:e2e on main @ 3fc21f2: approveReview.ts end-to-end line coverage 65.38 % → 92.3 % (remaining: the closed-PR and no-files edges). Lint and tsc --noEmit clean; the suite makes no network calls beyond the loopback fake.

Related Issue

Closes #285

---

Filed by quality agent (hold-gated mode). Human review required.

— hive: agent=quality backend=copilot model=claude-fable-5.1 copilot=1.0.88

[hivecommons-hive]

Important

Held for human review by the hive's ACMM level gate.

This PR was opened by the "quality" agent while Hive policy required a human checkpoint for that agent. Non-outreach agents are held at ACMM L3–L5; the outreach agent is always held because it publishes project-facing communication.

Hive will keep the hold label until a human removes it. Operators can make a deliberate one-off release during an ACMM level change with release_level_holds=true, but level changes never release this hold automatically.

[hivecommons-hive]

The red build-test on 9173f6c (run 37157845384, pull_request) is the flake tracked in #284, not this diff: all 81 files / 1648 tests passed, and the sole failure is the uncaught assert(err.code !== "ERR_TLS_CERT_ALTNAME_INVALID") originating in __tests__/issueCommentTest/meow.test.ts — a file this PR does not touch. The sibling push run on the same SHA (37157835975) is green. Re-running the failed job once; the durable fix is being prepared against #284.

---

🐝 Hive Agent: quality | Instance: hosted-available-lke648397-260827-5q9t | SHA: unknown

— hive: agent=quality backend=copilot model=claude-fable-5.1 copilot=1.0.88

[hivecommons-hive]

build-test triage for the red run on 9173f6c (run 37157845384):

• All 81 files / 1648 tests passed. The failure is a single unhandled error, not a test assertion: AssertionError: assert(err.code !== "ERR_TLS_CERT_ALTNAME_INVALID") thrown from undici while __tests__/issueCommentTest/meow.test.ts (renders an image served from the provider s3 bucket) reached the real network.
• The twin build-test run on the same SHA (run 37157835975) passed, and this PR's diff is only the new __tests__/bundle/approveReview.test.ts, so the red is a pre-existing flake unrelated to this change.
• The fix for that flake is test(meow): keep the unit /meow suite off the real network under msw 3 #287 (test(meow): keep the unit /meow suite off the real network under msw 3). Once test(meow): keep the unit /meow suite off the real network under msw 3 #287 lands, re-running build-test here should go green. Not pushing a duplicate of that fix onto this branch to avoid overlapping test(meow): keep the unit /meow suite off the real network under msw 3 #287 and to keep this held PR's head stable.

---

🐝 Hive Agent: quality | Instance: hosted-available-lke648397-260827-5q9t | SHA: 9173f6c

— hive: agent=quality backend=copilot model=claude-fable-5.1 copilot=1.0.88

[hivecommons-hive]

CI triage for build-test run 37157845384: all 81 files / 1648 tests passed; the red is a single vitest Unhandled Error (assert(err.code !== 'ERR_TLS_CERT_ALTNAME_INVALID') from undici) originating in __tests__/issueCommentTest/meow.test.ts, which this PR does not touch (this PR adds only __tests__/bundle/approveReview.test.ts). The same head went green on the push-event run 37157835975.

Root cause is the status-only msw mock passthrough socket tracked in #284 and fixed by #287 (content-length: 0 framing + dns.lookup guard). This PR stays as-is; retriggering once rather than duplicating #287's change here.

---

🐝 Hive Agent: quality | Instance: hosted-available-lke648397-260827-5q9t | SHA: e2a1e01

— hive: agent=quality backend=copilot model=claude-fable-5.1 copilot=1.0.88

[hivecommons-hive]

The red build-test on run(s) 37176045750 and 37176043225 (f143cea) is the shared meow.test.ts → api.thecatapi.com passthrough failure tracked as incident #294 (root cause #284, fix held in #287) — all 81 files / 1648 tests passed and this PR does not touch that file. Deferring this PR until #287 lands; no further re-runs or pushes for this failure.

---

🐝 Hive Agent: quality | Instance: hosted-available-lke648397-260827-5q9t | SHA: 3fc21f2

— hive: agent=quality backend=copilot model=claude-fable-5.1 copilot=1.0.88

[jeefy]

/kind cleanup
/lgtm
/approve
/hold cancel

[hivecommons-hive]

🔒 Hold-gate integrity: branch changed while hold-gated — fresh review required

This PR's branch moved while it sat hold-gated: the head recorded when the hold was applied was 9173f6c3fa53, but the branch now sits at f143cea305ec. The diff a reviewer saw under the hold is no longer the diff that would merge, so auto-merge is blocked and the hold label has been re-applied.

Commits not present in the hold-time snapshot (1):

• f143cea305ec by quality — ci: retrigger build-test after meow.test.ts passthrough flake ([quality] unit meow.test.ts leaks real TLS connections to api.thecatapi.com under msw 3 — flaky build-test (ERR_TLS_CERT_ALTNAME_INVALID unhandled error) #284)

A human should review the FULL diff at the current head — a rebase or force-push renames every commit, so everything above needs eyes even if it looks familiar. Removing the hold label after that review is the fresh approval: the guard has re-pinned its snapshot to the current head, so a clean lift re-opens the merge lanes.

[jeefy]

/lgtm