test(bundle): drive the issue-side OWNERS fallback and the membership probes' 500 arms through dist/index.js

[hivecommons-hive]

Test Improvement

Adds __tests__/bundle/rootOwnersFallback.test.ts, a bundle (end-to-end) suite that drives src/utils/auth.ts's issue-side assertAuthorizedByOwnersOrMembership arm through dist/index.js against the fake GitHub. On an issue (not a pull request) the plugin reads the root OWNERS file via retrieveOwnersFile → assertRootOwner and falls back to org membership / collaborator status when it is absent; no existing bundle test reached that arm (the only /lgtm on an issue is refused as the author before authorization runs).

Five tests, /lgtm by a non-author on issue #1 unless noted:

route	expected
root OWNERS 404, org-membership read 500, collaborator 204	::warning::encountered unexpected error: status=500, message=boom, lgtm applied, then the post-command config reads
root OWNERS 404, org and collaborator both 404	refused Codertocat is not a org member or collaborator, exit 1, no label write
root OWNERS 500	refused error checking for an OWNERS file at the root of the repository: HttpError: boom, no membership read
root OWNERS is a directory (contents API lists it without content)	refused invalid OWNERS file returned from GitHub API, no membership read
/unassign @octocat by a non-member whose issue-comments read 500s	::warning::encountered unexpected error checking issue comments: status=500, message=boom, no DELETE …/assignees

Each test also asserts the exact request sequence (contents/OWNERS → orgs/…/members → collaborators/… → write/comment → config reads via expectCommandThenConfig).

Measured with npm run test:coverage:e2e on main @ 3fc21f2: auth.ts end-to-end 63.1 % → 81.55 % lines (62.85 → 80.95 % stmts, 53.12 → 71.87 % branches, 78.57 → 92.85 % funcs). auth.ts:257, 61, 64, 135-139, 349-350, 353, 358-359 go from 0 hits to covered. All files: 77.9 → 78.7 % lines, 6 files / 147 tests.

Disjoint from the held PRs: #283 (ownersAuth.test.ts) covers the root-OWNERS-present arms (auth.ts:277-288, 362-364) and the PR-side no OWNERS file covers arm (321-322); #306 covers checkCollaborator's 500 arm (98, 101). Those lines are not asserted here. Files touched: __tests__/bundle/rootOwnersFallback.test.ts only (new); src/, dist/, vitest.config.mjs and .github/ unchanged.

Verified locally: npx vitest run __tests__/bundle/rootOwnersFallback.test.ts (5 passed), npx eslint __tests__/bundle/rootOwnersFallback.test.ts clean.

Related Issue

Closes #330

---

Filed by quality agent (hold-gated mode). Human review required.

— hive: agent=quality backend=copilot model=claude-fable-5.1

[hivecommons-hive]

Important

Held for human review by the hive's ACMM level gate.

This PR was opened by the "quality" agent while Hive policy required a human checkpoint for that agent. Non-outreach agents are held at ACMM L3–L5; the outreach agent is always held because it publishes project-facing communication.

Hive will keep the hold label until a human removes it. Operators can make a deliberate one-off release during an ACMM level change with release_level_holds=true, but level changes never release this hold automatically.

[jeefy]

Four of the five cases add coverage.

• rootOwnersFallback.test.ts:64 and :133: check a fragment, e.g. some(w => w.includes('status=500')), instead of comparing the whole ::warning:: line with toEqual.
• Drop :71. Its root-OWNERS 404 fallback lines are already reached by L53, and the "not a org member or collaborator" refusal is covered on main.

[hivecommons-hive]

Addressed: both ::warning:: assertions now check a status=500 fragment, and the root-OWNERS-404 + non-member refusal case is dropped. Merged main.

---

🐝 Hive Agent: quality | Instance: hosted-available-lke648397-260827-5q9t | SHA: unknown

— hive: agent=quality backend=copilot model=claude-fable-5.1

[hivecommons-hive]

Addressed in 8eff51a: both warning checks use a status=500 fragment and the duplicated membership-refusal case is dropped.

CI is green on the new head.

---

🐝 Hive Agent: quality | Instance: hosted-available-lke648397-260827-5q9t | SHA: 1f7d33c

— hive: agent=quality backend=copilot model=claude-fable-5.1 copilot=1.0.88

[jeefy]

Asks addressed; verified on current main (aa6a0f8) together with the other approved PRs.

[jeefy]

/kind cleanup
/lgtm
/approve
/hold cancel

[hivecommons-hive]

🔒 Hold-gate integrity: branch changed while hold-gated — fresh review required

This PR's branch moved while it sat hold-gated: the head recorded when the hold was applied was 8989c7444c96, but the branch now sits at 8eff51a5344d. The diff a reviewer saw under the hold is no longer the diff that would merge, so auto-merge is blocked and the hold label has been re-applied.

Commits not present in the hold-time snapshot (2):

• b37db2788d32 by quality — Merge remote-tracking branch 'origin/main' into quality/test-root-owners-fallback
• 8eff51a5344d by quality — test(bundle): check warning fragments and drop the duplicated membership refusal

A human should review the FULL diff at the current head — a rebase or force-push renames every commit, so everything above needs eyes even if it looks familiar. Removing the hold label after that review is the fresh approval: the guard has re-pinned its snapshot to the current head, so a clean lift re-opens the merge lanes.