test(bundle): drive the https:// config source (config.ts fetchUrl) through dist/index.js

[hivecommons-hive]

Test Improvement

Adds __tests__/bundle/httpsConfigSource.test.ts (new file only; imports comment, configReads, helpersFor, repo, token from ./helpers; runBundle.ts, fakeGithub.ts, helpers.ts, source and dist/ untouched). It is the first bundle test to reach fetchUrl in src/utils/config.ts (L290–301), the arm that loads an https:// config input with fetch rather than the api — the one config.ts cluster #314 left out ("needs a TLS server the fake GitHub does not provide").

How: beforeAll mints a throwaway self-signed certificate with openssl into a temp dir (/CN=localhost, SAN IP:127.0.0.1, 1 day), starts an in-process https.createServer on it, and runBundle's env hands the cert to the child as NODE_EXTRA_CA_CERTS, so the bundled fetch completes a real TLS handshake without touching the network or a real CA. Three /kind cleanup runs on issue #1:

TLS server's answer	expected
200 labels: { kind: [cleanup] }	exit 0, POST …/issues/1/labels {labels:['kind/cleanup']}; exactly one GET /prow.yaml on the TLS server; no .project/.github org probe; the repository tier's eight reads and GET …/labels still happen (L290–291 + L301)
500	exit 1, could not get labels from yaml: Error: could not load prow config from https://127.0.0.1:<port>/prow.yaml: HTTP 500, no write (L297–298)
server closed	exit 1, … could not load prow config from https://127.0.0.1:<port>/prow.yaml: TypeError: fetch failed, no request reaches the live server, no write (L293–294)

Measured with npm run test:coverage:e2e on main @ 3fc21f2: src/utils/config.ts e2e lines 68.78 % → 72.19 % (L290–301 all reached); all files 77.9 % → 78.28 %. npx vitest run __tests__/bundle/httpsConfigSource.test.ts → 3 pass against the committed dist/index.js; npx eslint and tsc --noEmit clean.

Disjoint from #314 (owner/repo:path[@ref] sources and api read failures, L236–282) and #339 (parseProwConfig rejections); neither routes an https:// source.

Related Issue

Closes #358

---

Filed by quality agent (hold-gated mode). Human review required.

— hive: agent=quality backend=copilot model=claude-fable-5.1 copilot=1.0.88

[hivecommons-hive]

Important

Held for human review by the hive's ACMM level gate.

This PR was opened by the "quality" agent while Hive policy required a human checkpoint for that agent. Non-outreach agents are held at ACMM L3–L5; the outreach agent is always held because it publishes project-facing communication.

Hive will keep the hold label until a human removes it. Operators can make a deliberate one-off release during an ACMM level change with release_level_holds=true, but level changes never release this hold automatically.

[jeefy]

/kind cleanup
/lgtm
/approve
/hold cancel

[jeefy]

/lgtm