🐝 Hive Advisory Report #170

Activity

1. github-actions

   added

   needs-kind

   on Sep 24, 2026
2. hivecommons-hive commented on Sep 25, 2026

   

   hivecommons-hiveBot

   on Sep 25, 2026 – with hivecommons-hive

   Last edited by hivecommons-hive

   ContributorAuthor

   More actions

   🐝 Advisory Digest — 2026-10-21 23:10 EDT

   Automated code review findings from Hive agents. Each finding includes a file reference and suggested fix. This comment is updated periodically.

   Advice

   Frozen for governor mode IDLE until 2026-10-22 (next review in 1 day(s)). The list of recommendations is frozen; their numbers, items and links are recomputed on every digest.

   Counts quoted: governor actionable queue 1 PRs / 0 issues (what mode and cadence key on; excludes held, draft, in-review and human-gated items) — Overview chart 7 open PRs / 0 open issues (every open or held item across repo cards; the queue-health advice counts these).

   • Clear the human gate on PRs — 6 of 7 open PRs (85%) wait on a human: 6 held, 0 labelled needs-human, 0 needs-decision — release, review, or close them. (signals: overview_open_prs=7, needs_human=6, held=6, needs_human_label=0, needs_decision=0)
     • First: prow-github-actions#553 (held), prow-github-actions#556 (held), prow-github-actions#557 (held), prow-github-actions#558 (held), prow-github-actions#559 (held)
     • Full list: Needs-human PRs (CSV)
   • Give idle agents a cadence — No longer applies: the signal that triggered this advice has cleared since the epoch began.
   • Close what agents already finished — No longer applies: the signal that triggered this advice has cleared since the epoch began.

   Bands named above (same rules as the Overview chart):

   • Needs human (PRs): held, or labelled needs-human, stage/085-needs-decision, needs-decision, 2-discussing, blocked, stage/045-needs-decision, epic, needs-triage — a human must review, decide, or release the hold before automation continues

   Findings: 10

   💡 Showing top 10 findings (by severity). 294 more exist. Set governor.advisory.show_all: true to see all.

   Severity	Count
   🟠 high	10

   🟠 HIGH (10)

   • [advisory] tide: evaluateMerge's post-retry lgtm gate re-check had no killing test in unit or bundle suites (fixed by quality PR) src/plugins/tide.ts:203 quality

     Removing the blockedReason(pr, tide) re-check after fetchMergeability in evaluateMerge (tide.ts:203) survived all 982 unit tests and the rebuilt bundle suite (528) at main e3119ad; an lgtm removed during the unknown-mergeability retry would merge. Unit evidence: npm run test:coverage (99.92% stmts) shows the line covered, so this is an assertion gap not a line gap. Fixed by cncf/prow-github-actions#557 (hold). Refs Follow-up: strengthen test contracts, CI enforcement, release delivery, and quality triage #554.

   • [advisory] pullRequestOwners.ts: draft/labels defaults test vacuous; Set dedupe and repository-keyed memos survive deletion under unit and e2e suites src/utils/pullRequestOwners.ts quality
   • [advisory] prow-github-actions: test:coverage:e2e never runs in CI; coverage-e2e/ unarchived; thresholds all 0 — no regression gate on the e2e lane .github/workflows/test.yml quality

     main@d93ecb8: test.yml build-test runs only npm run test:coverage (unit). npm run test:coverage:e2e (added by test(coverage): add test:coverage:e2e to report the bundle suite's coverage of src/ #274, basis of ~60 e2e-coverage findings on [quality] coverage-e2e names tide.ts:99 uncovered; the zero is the never-reached options.initial ?? await getPull fallback on line 98 #466) never runs in CI, coverage-e2e/ is never uploaded, and vitest.e2e-coverage.config.mjs pins all thresholds to 0. Local baseline main@d93ecb8: lines 99.54 / stmts 99.56 / funcs 98.79 / branches 96.25 (461 bundle tests). Fix: CI step + artifact (workflow file, needs human) and thresholds 99/99/98/95 (test-config PR).

   • [advisory] prow-github-actions#440: push-repacked-dist fails — Dependabot secrets REPACK_APP_ID/REPACK_APP_PRIVATE_KEY never configured after ci: repack dist/ on dependabot branches without exposing a write token #390; bundled-dep dependabot bumps still red on dist/ gate .github/workflows/test.yml ⚠️ (not re-reported within the staleness window — still open, but not recently verified) quality

     Run 38068101038 on chore(deps): bump js-yaml from 5.4.2 to 5.4.3 in the production-dependencies group #440: repack-dist success (changed=true), push-repacked-dist fails at create-github-app-token: app-id empty (Secret source: Dependabot). REPACK_APP_ID/REPACK_APP_PRIVATE_KEY Dependabot secrets from ci: repack dist/ on dependabot branches without exposing a write token #390 never configured. Maintainer-only fix; recorded on [quality] config.ts:305 — the explicit config source's not found arm is never driven through dist/index.js #422 fold comment + PR 440 comment.

   • [advisory] 0-byte OWNERS file fails every OWNERS-reading run: decode treats content '' as missing (owners.ts:163, auth.ts:493) src/utils/owners.ts ⚠️ (not re-reported within the staleness window — still open, but not recently verified) quality

     GitHub returns an empty blob as content:'' encoding:'base64' (verified: gh api repos/cncf/prow-github-actions/git/blobs/e69de29...). decode() in owners.ts:163 and retrieveOwnersFile in auth.ts:493 test !content, so a 0-byte OWNERS file fails /approve, /lgtm and the OWNERS plugins with 'invalid OWNERS file returned from GitHub API' instead of parsing as nobody-listed. Unit tests pin only the missing-key shape (ownersAuth.test.ts:296, auth.test.ts:362). Filed cncf/prow-github-actions#404 for a maintainer (production fix).

   • …plus 4 more [advisory] findings from quality, collapsed to keep lower-severity sections within GitHub's comment limit
   • [coverage-gap] sweep.ts delayed-reviewers OWNERS guard (line 80 false arm) covered by neither unit nor bundle suite src/cronJobs/sweep.ts quality

     Unit: npm run test:coverage main@e3119ad (2330 tests) coverage/lcov.info BRDA:80,4,1,0. E2E: npm run test:coverage:e2e main@e3119ad (528 tests) coverage-e2e/lcov.info BRDA:80,4,1,0; suites read separately per docs/contributing.md. Mutant '|| true' on the branchHasOwners guard accepted by both suites. Issue cncf/prow-github-actions#560; hold PR on branch quality/test-sweep-delay-no-owners adds one case per suite in new files.

   ☑️ Recently Closed — Fix Not Verified (10)

   Closed on an agent's word or a hive heuristic (a merged PR's title matching the finding, or the issues/PRs it cites closing). The hive did not re-check the condition, so it may still hold.

   • prow-github-actions#552: docs-only PR correctly documents V8 negative-BRDA artifact, no issues found #552 scanner — closed Oct 21 (the issues/PRs it cites closed), fix not verified
   • PR Add optional delay for blunderbuss #530 (blunderbuss-delay) CI checks stuck in action_required for 23+h, blocking required checks runs 39346583818, 39346663667, 39347264990 (Build and test code / Prow bot, pull_request, PR #530) ci-maintainer — closed Oct 21 (the issues/PRs it cites closed), fix not verified
   • prow-github-actions#536: lgtm.ts:68 String(e) catch arm unreachable — bindLgtm only ever throws Error #536 scanner — closed Oct 21 (the issues/PRs it cites closed), fix not verified
   • prow-github-actions#507: getErrorDetails non-object branch (auth.ts:24-27) unreachable — Octokit always rejects with RequestError object #507 scanner — closed Oct 21 (the issues/PRs it cites closed), fix not verified
   • prow-github-actions#507: PR test(bundle): serve comment.body and label.name absent to drive the '?? ""' folds through dist/index.js #508 merged but never touches auth.ts — issue's getErrorDetails fix still unimplemented #507 scanner — closed Oct 21 (the issues/PRs it cites closed), fix not verified
   • prow-github-actions#546: dependabot vite 8.3.1→8.3.4 devDep bump — clean, low-risk, CI green, safe to auto-merge #546 scanner — closed Oct 21 (the issues/PRs it cites closed), fix not verified
   • No CODE_OF_CONDUCT.md or Code of Conduct reference (expected for a CNCF project) README.md guide — closed Oct 20 (no evidence recorded), fix not verified
   • docs/overview.md never enumerates src/ module layout or run.ts event-dispatch table docs/overview.md guide — closed Oct 20 (no evidence recorded), fix not verified
   • prow-github-actions: command.ts:23 getLineArgs '?? ""' arm unreachable from dist/index.js (dispatch guards with hasCommand); e2e-only reporting gap, same v8-ignore class as run.ts:40/config.ts:657 src/utils/command.ts quality — closed Oct 20 (no evidence recorded), fix not verified
   • Health sweep: cncf/prow-github-actions pipeline — all 4 active agents confirmed live via hive-panes, no kick needed supervisor — closed Oct 20 (no evidence recorded), fix not verified
   • …plus 6 more closed without a verified fix in the last 48h, collapsed so the open findings above stay readable

   ---

   Analyzed at cncf/prow-github-actions@e3119adfdf11 (branch main) — the latest commit when this digest was generated. File references that no longer exist at this commit are flagged as outdated. Findings marked ⚠️ were computed at an older commit and have NOT been re-verified here.
3. mrbobbytables commented on Oct 11, 2026

   

   mrbobbytables

   on Oct 11, 2026

   Member

   More actions

   /kind cleanup
4. github-actions

   added

   kind/cleanupCategorizes issue or PR as related to cleaning up code, process, or technical debt.Categorizes issue or PR as related to cleaning up code, process, or technical debt.

   and removed

   needs-kind

   on Oct 11, 2026
5. hivecommons-hive commented on Oct 21, 2026

   

   hivecommons-hiveBot

   on Oct 21, 2026 – with hivecommons-hive

   ContributorAuthor

   More actions

   Folded finding. This was filed as a separate issue, but 1 open agent-filed issue (plus 4 closed as completed in the last 14 days) already cite src/utils/auth.ts, so it was folded into the oldest of them instead of opening another. Treat this issue as the tracker for that component: prefer one structural fix that covers every folded variant over a PR per variant.

   [quality] coverage-e2e: getErrorDetails' status-less and message-less object folds (auth.ts:15-17) are never driven through dist/index.js

   Finding

   npm run test:coverage:e2e on main @ 3eb343b (84 files / 506 tests, local run; 100 % lines / 99.03 % branches overall) lists src/utils/auth.ts at 96.55 % branches with zero-hit BRDA records at lines 15-17, the two folds inside getErrorDetails's object arm:

   const status = 'status' in error ? error.status : 'unknown'          // else-arm: object without `status`
   const message = 'message' in error && typeof error.message === 'string'
     ? error.message
     : String(error)                                                     // else-arm: object without a string `message`

   Both else-arms are unit-covered (npx vitest run --coverage on the same revision: auth.ts 100 % lines / 98.85 % branches, the only residual being the negative-count artifact at line 220 that #511 documents), so this is an e2e-only gap. They are unreachable from any response the fake GitHub can serve: @octokit/request wraps every non-2xx response and every fetch rejection in a RequestError, which always carries both status and message. The remaining three zero-hit auth.ts records on main (line 220 and the now-closed line 24 that #528 drove) are accounted for; 15-17 are the last auth.ts folds no bundle scenario exercises.

   The other 14 zero-hit branches in the same run are all claimed: run.ts:40, command.ts:23, config.ts:657 (#544); lgtm.ts:68 (#537); requireMatchingLabel.ts:167 (#549); tide.ts:137-138, mergeQueue.ts:190, sweep.ts:132, trigger.ts:323, approveReview.ts:226,230 (#548); approve.ts:504 and auth.ts:220 (v8 await artifact, #511).

   Recommendation

   Drive the folds with the preload technique #528 merged: hand the bundle one Response whose status getter throws — the one read @octokit/request makes outside its try/catch — but throw a plain object rather than a string, so the rejection reaches getErrorDetails's object arm without the RequestError wrapper. Two /retitle runs through checkCollaborator cover both arms:

   • { code: 'ECONNRESET', message: 'socket hang up' } → ::warning::… status=unknown, message=socket hang up, write denied
   • { status: 502, code: 'EAI_AGAIN' } → ::warning::… status=502, message=[object Object], write denied

   Keep the preload a separate file from __tests__/bundle/nonErrorRejectionPreload.cjs: #548 ships a byte-identical copy of that file and relies on it not changing.

   Decision taken by hive: new test files only, no src/, dist/ or threshold change; the [object Object] message the second case pins is the current behaviour and is recorded, not changed.

   Priority

   • Impact: medium (unit-covered, e2e-uncovered; last unclaimed auth.ts fold)
   • Effort: low

   ---

   Filed by quality agent (hold-gated mode)

   ---

   🐝 Hive Agent: quality | Instance: hosted-available-lke648397-260827-5q9t | SHA: 3eb343b

   — hive: agent=quality backend=copilot model=claude-fable-5.1 copilot=1.0.88
6. hivecommons-hive

   added

   stage/040-covered-by-prAn open PR covers this issueAn open PR covers this issue

   and removed

   stage/040-covered-by-prAn open PR covers this issueAn open PR covers this issue

   on Oct 21, 2026