Repository navigation
test(bundle): drive removeFixedLabels' no-op and failed-labels-read arms through dist/index.js - #300
Merged
Conversation
…rms through dist/index.js __tests__/bundle/fixedLabelArms.test.ts runs the shipped bundle against the fake GitHub for the two arms of src/labels/fixed.ts removeFixedLabels that no bundle suite reaches: a /remove- form whose labels are not on the issue (one GET /issues/1, no DELETE or POST, exit 0) and a 500 on that read (exit 1, the error names 'could not get labels from issue'). npm run test:coverage:e2e: fixed.ts 7/21 -> 19/21 lines. Signed-off-by: quality <quality@hive.kubestellar.io>
hivecommons-hive
Bot
added
the
hold
Contributor
Author
|
Important Held for human review by the hive's ACMM level gate. This PR was opened by the "quality" agent while Hive policy required a human checkpoint for that agent. Non-outreach agents are held at ACMM L3–L5; the Hive will keep the |
hivecommons-hive
Bot
added
the
hold
Contributor
Author
|
/kind cleanup 🐝 Hive Agent: — hive: agent=quality backend=copilot model=claude-fable-5.1 copilot=1.0.88 |
github-actions
Bot
added
the
kind/cleanup
This was referenced Oct 4, 2026
Merged
Member
|
/kind cleanup |
github-actions
Bot
removed
the
hold
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
github-actions
Bot
added
the
lgtm
1 task
jeefy
added a commit
to jeefy/prow-github-actions
that referenced
this pull request
Oct 7, 2026
…remove-help and /remove-good-first-issue The fixed label commands now read the configuration for authorization.labels before writing, and the needs-* re-check that follows finds it memoized. The two bundle cases main gained in cncf#246 and cncf#300 pinned the configuration reads after the command; they now pin them ahead of the unchanged command sequence, as bundle.test.ts does for /help. Signed-off-by: Jeffrey Sica <me@jeefy.dev>
jeefy
added a commit
that referenced
this pull request
Oct 7, 2026
…view commands (#367) * feat(auth): opt-in authorization policy for label, hold, close and review commands A new top-level `authorization` section in prow.yaml decides who may run the label commands (`labels`), /hold (`hold`), /close and /reopen (`close`), and, on repositories without OWNERS files, /lgtm, /approve, /retest, /test and /ok-to-test (`review`). Policies are anyone | collaborators | members | trusted; `trusted` adds the `users` list and the root OWNERS reviewers and approvers. `review` accepts only members | trusted. Defaults reproduce today's gates exactly (labels/hold anyone, close collaborators, review members, users []). Per key the repository tier wins over the organization tier, except `users`, which is unioned case-insensitively. `anyone` makes no API call. /close, /reopen and the review fallback keep their existing checks and request order and read the configuration only when those checks refuse, which is exact because every policy admits collaborators (close) and members/collaborators (review). /help and /good-first-issue now read the configuration before writing, as the prefixed label commands already did. Signed-off-by: Jeffrey Sica <me@jeefy.dev> * docs: document the authorization section Adds the `### authorization` section to docs/configuration.md (fields, policies, the `users` union, review only applying without OWNERS files, the OWNERS side-effect warning and the missing_comment note), the policy column and refusal behaviour in docs/commands.md, a parity row in docs/prow-for-your-org.md and a commented-out block in templates/prow.yaml. Signed-off-by: Jeffrey Sica <me@jeefy.dev> * fix(auth): fail closed when the authorization config cannot be loaded Security review follow-ups for the authorization section: - the review fallback of assertAuthorizedByOwnersOrMembership logs a warning and falls back to the default `members` policy when the configuration cannot be loaded, so the refusal comment carries the usual `members` message and never the configuration error; - closePolicyAllows logs a warning and refuses when the configuration cannot be loaded, keeping a refused /close or /reopen silent; - policyAllows refuses an empty login before anything else; - authorization.users entries are trimmed and must be GitHub logins (optionally with a `[bot]` suffix); a leading `@`, inner spaces, underscores or teams are rejected; - docs: the org tier supplies defaults, not floors (use rulesets for enforcement), the `config` input may point at a ref or URL, review applies to issues without a root OWNERS file, and the refusal behaviour when the configuration cannot be loaded. Signed-off-by: Jeffrey Sica <me@jeefy.dev> * test(bundle): expect the authorization.labels config reads ahead of /remove-help and /remove-good-first-issue The fixed label commands now read the configuration for authorization.labels before writing, and the needs-* re-check that follows finds it memoized. The two bundle cases main gained in #246 and #300 pinned the configuration reads after the command; they now pin them ahead of the unchanged command sequence, as bundle.test.ts does for /help. Signed-off-by: Jeffrey Sica <me@jeefy.dev> --------- Signed-off-by: Jeffrey Sica <me@jeefy.dev>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Test Improvement
Adds
__tests__/bundle/fixedLabelArms.test.ts(one new file; nothing else touched), running the committed bundle against the fake GitHub for the two arms ofsrc/labels/fixed.tsremoveFixedLabelsno bundle suite reaches:/remove-good-first-issuewith none of its labels on the issue: exit 0, oneGET /issues/1, then the post-command config sweep, noDELETE/POST(lines 58–60)/remove-helpwithGET /issues/1→ 500: exit 1, the failure namescould not get labels from issue, noDELETE(lines 54–56)Both import
comment/helpersFor/repo/tokenfrom the sharedhelpers.ts(#273).Measured with
npm run test:coverage:e2eonmain@ 3fc21f2:src/labels/fixed.tse2e lines 7/21 → 19/21 (33.3 % → 90.5 %). Line 63 (theremoveLabelswrite on the happy path) is #246's ground and is not claimed here; line 70 (requireIssueNumberthrow) is unreachable from anissue_commentpayload. Unit coverage of the file is already 100 %.Disjoint from every open held bundle PR: #246 drives the
/remove-helphappy path inlabelCommands.test.ts; this file drives only the no-op and failure arms.Related Issue
Closes #299
Filed by quality agent (hold-gated mode). Human review required.
— hive: agent=quality backend=copilot model=claude-fable-5.1 copilot=1.0.88