[hivecommons-hive]

Test Improvement

Nothing type-checks __tests__/ today: tsconfig.json excludes it, Vitest's esbuild transform strips types without checking them, and ESLint runs without a tsconfigPath. Running tsc --noEmit over src/ and __tests__/ together at main@9acb046 reports 29 errors in 17 files, several of them fixtures that drifted from the production types they claim to be:

• PullRequestOwners gained headSha; the pullOwners() fixture in approve.test.ts, approveErrorPaths.test.ts and approveGuards.test.ts still builds the old shape
• ProwConfig gained approve, lgtm, sweep, authorization; the hand-built configs in blunderbuss.test.ts and requireMatchingLabel.test.ts carry only the original six keys (now built from mergeProwConfig({}, {}))
• msw 3 renamed SetupServerApi → SetupServer; testUtils.ts:1 has imported a non-existent type since the bump
• missingNumberMessage.test.ts:1 imports @actions/github/lib/context, which docs/contributing.md forbids; now imports src/utils/context
• lgtmBinding.test.ts builds a sender without the type the payload type requires
• the rest: untyped vi.spyOn declarations (tide.test.ts, tideGuards.test.ts — .mock.calls was any), an untyped it.each table (ownersGuards.test.ts), unresolved this (fakeGithub.ts), delete on a required field (sweepArms.test.ts), over-narrow createLabel parameter (labelSync.test.ts), a milestone intersection that can never be null (milestone.test.ts), vi.spyOn over a module/name union (handleIssueComment.test.ts), index-signature mismatches (configurationDocs.test.ts)

This PR adds tsconfig.test.json (extends tsconfig.json, noEmit, includes src/ + __tests__/, excludes the coverageEntry build which has its own tsconfig), an npm run typecheck script, fixes all 29 errors, and documents the command in docs/contributing.md (Development section). npm run build is unchanged. No test semantics change: npx vitest run → 191 files, 2473 passed / 75 skipped, identical to main.

Files / cluster claimed

tsconfig.test.json (new), package.json (typecheck script only), docs/contributing.md (Development section, not the Testing table), and type-only edits to the 17 test files listed above. Verified with git merge-tree --write-tree against held #591 #593 #595 #596 #597 #598: all six merge cleanly with this branch.

Still waiting on a human: the CI step

The enforcing step lives in .github/workflows/test.yml, which this agent's token tier cannot push. It is one line in job build-test, after npm run build:

      - run: npm run typecheck

Two held PRs would fail that step once it lands and should get a one-line fix on their own branches first: #593 meowImageEdges.test.ts:45 (ReturnType<typeof vi.spyOn<…>> → MockInstance<typeof comments.createComment>), #595 setup.ts:16 (type the _super parameter) and configTypeGuards.test.ts:22 (labels.kind possibly undefined). Merging this PR on its own does not break them — only the future CI step would.

Related Issue

Refs #170 (needs-human: the - run: npm run typecheck step in .github/workflows/test.yml cannot be pushed at this agent's token tier; the finding was folded onto #170 by the hive under component test.yml)

---

Filed by quality agent (hold-gated mode). Human review required.

— hive: agent=quality backend=copilot model=claude-fable-5.1 copilot=1.0.88

[hivecommons-hive]

Important

Held for human review by the hive's ACMM level gate.

This PR was opened by the "quality" agent while Hive policy required a human checkpoint for that agent. Agent PRs are held at ACMM L3–L5; an outreach PR that targets a repository this hive does not manage is held at every level because it publishes project-facing communication into someone else's project.

Hive will keep the hold label until a human removes it. Operators can make a deliberate one-off release during an ACMM level change with release_level_holds=true, but level changes never release this hold automatically.

[hivecommons-hive]

e2f71df

ℹ️ Sentinel notice — informational; author is trusted (hive agent), merge is not blocked

Hive flagged this PR (author @hivecommons-hive[bot], head e2f71dfe5dbe) because it matches behaviors that can override security controls, escalate privileges or damage the codebase. This is a heuristic, not an accusation — a maintainer should confirm the change is intended before it merges.

• sensitive_path — changes 1 sensitive path(s) (Touches a sensitive path (OWNERS, workflows, policies, hive config, security docs, …))
  • package.json

Hive did not add the sentinel-alert label because this author is trusted. The finding remains recorded for audit and the dashboard Security tab; set sentinel.trusted_authors_block: true to require the blocking label for trusted authors too.

[hivecommons-hive]

Verified locally at head e2f71df, independent of the PR description: on main@9acb046 with this PR's tsconfig.test.json, npx tsc -p tsconfig.test.json reports exactly 29 errors; on this branch it reports 0. The three production-type claims hold in the tree: PullRequestOwners.headSha is a required field (src/utils/pullRequestOwners.ts:14) consumed by approveReview.ts:180/197, mergeProwConfig is exported at src/utils/config.ts:754 and returns the full default config the fixtures now spread, and Context is exported from src/utils/context.ts:3, which is the alias docs/contributing.md mandates over @actions/github/lib/context.

Every hunk is type-level only; the two that change runtime code are behavior-preserving:

• __tests__/bundle/fakeGithub.ts:146-157 — this.unexpectedRequests() becomes a closure reference to the same object. Equivalent at every current call site, and strictly safer if assertNoUnexpectedRequests is ever destructured.
• __tests__/configurationDocs.test.ts:75-79 — spreading the settings objects into plain records; toEqual semantics unchanged, and CI's build-test + e2e-coverage are green on this head.

docs/contributing.md documents the new npm run typecheck, and package.json adds only that script; npm run build is untouched.

The remaining piece — the - run: npm run typecheck line in .github/workflows/test.yml — is correctly left to a human (Refs #170) since workflow files are outside this token tier; until it lands, the script is opt-in. The body's note that held #593 and #595 would fail that future step matches what their diffs add and does not block this PR.

Looks correct to me. No findings.

— hive: agent=reviewer backend=copilot model=claude-fable-5 copilot=1.0.88

[hivecommons-hive]

/kind cleanup

---

🐝 Hive Agent: quality | Instance: hosted-available-lke648397-260827-5q9t | SHA: 9acb046

— hive: agent=quality backend=copilot model=claude-fable-5.1 copilot=1.0.88

[hivecommons-hive]

⚠️ Hold-gate mergeability: this PR has a real conflict with its base

This PR is hold-gated and has fallen behind its base branch. The hive tried to merge the base in to keep it mergeable while it waits on review, but that merge conflicts and the hive cannot resolve it automatically.

It will stay held and will NOT merge on its own even once reviewed — removing hold alone will not be enough. Someone will need to merge or rebase the base branch in by hand (or resolve the conflict another way) before this PR can merge.

[hivecommons-hive]

Merged origin/main (#607, RunState refactor) into this branch by hand, as the hold-gate mergeability notice asked: kept main's two-project build next to typecheck, and brought the two files #607 added under tsc -p tsconfig.test.json: portability.test.ts's in-memory Platform gains the now-required state(), and both files pass utils.failOnUnhandledRequest to server.listen instead of the msw-2-only option literal. npm run typecheck → 0 errors. Unit suite green locally after the merge; hold untouched.

---

🐝 Hive Agent: quality | Instance: hosted-available-lke648397-260827-5q9t | SHA: a69b326

— hive: agent=quality backend=copilot model=claude-fable-5.1 copilot=1.0.88

[hivecommons-hive]

a69b326

ℹ️ Sentinel notice — informational; author is trusted (hive agent), merge is not blocked

Hive flagged this PR (author @hivecommons-hive[bot], head a69b3261f4b4) because it matches behaviors that can override security controls, escalate privileges or damage the codebase. This is a heuristic, not an accusation — a maintainer should confirm the change is intended before it merges.

• sensitive_path — changes 1 sensitive path(s) (Touches a sensitive path (OWNERS, workflows, policies, hive config, security docs, …))
  • package.json

Hive did not add the sentinel-alert label because this author is trusted. The finding remains recorded for audit and the dashboard Security tab; set sentinel.trusted_authors_block: true to require the blocking label for trusted authors too.

[hivecommons-hive]

Verified locally at head a69b326:

• npm run typecheck (tsc -p tsconfig.test.json) passes on this branch.
• Applying only the new tsconfig.test.json to current main reproduces the drift: real errors in __tests__/bundle/fakeGithub.ts:157 (this typed as FakeGithub | PromiseLike<FakeGithub>), configurationDocs.test.ts:75-79 (settings types lack index signatures), sweepArms.test.ts:161, testUtils.ts:1 (msw's SetupServerApi → SetupServer), and the stale fixture shapes.
• The fixes are type-level only where it matters: fakeGithub.ts binds the object to a named const instead of this (same object, same behaviour); blunderbuss.test.ts/requireMatchingLabel.test.ts build configs from mergeProwConfig({}, {}) so future ProwConfig keys can't silently drift again; the spread copies in configurationDocs.test.ts keep toEqual semantics.

One observation, not a defect: nothing runs npm run typecheck automatically — .github/workflows/test.yml runs build/lint/test:coverage and npm run all omits it, so the drift this fixes can reaccumulate until the CI step lands (the body defers that to a human, consistent with this lane not pushing workflow files). A maintainer merging this may want to add the one-line CI step in the same breath.

Looks correct to me.

— hive: agent=reviewer backend=copilot model=claude-fable-5 copilot=1.0.88

[jeefy]

Type-checking tests/ is overdue; the 29 fixture drifts it found are real. Approving on content. It is conflicting with main — #607/#608/#614/#615 added files under tests/ (adapters/app, worker, server) that the new tsconfig.test.json will include; tests/worker/*.ts uses miniflare types and src/server/worker.ts is excluded from the main tsconfig on purpose, so expect to exclude tests/worker from tsconfig.test.json or give it its own program. Also #593 and #595 merged with the TS errors you flagged on them; fold those one-line fixes in here.

[mrbobbytables]

Rebased on #598 + main (a458931) and finished the parts the agent couldn't:

• feat(app): run on Cloudflare Workers; Platform.defer() for the grace period #615 fallout: tsconfig.test.json now excludes src/server/worker.ts / worker-env.d.ts (checked by tsconfig.worker.json with the Cloudflare types, mirroring tsconfig.json) and sets skipLibCheck — miniflare's bundled .d.ts alone produced ~800 zod-v4 errors.
• Fixed the 5 real errors tsc then found in the feat: run as a GitHub App — webhook adapter and Node server (beta) #608/feat(app): run on Cloudflare Workers; Platform.defer() for the grace period #615 tests: worker.test.ts deliver()'s id inferred the UUID template type; webhook.test.ts cast TokenSource to an unrelated shape.
• Added - run: npm run typecheck to build-test in test.yml (the "still waiting on a human" step) and noted it in contributing.md.

npm run typecheck, lint and the full unit + worker suites pass locally. Depends on #598. Heads-up: per the PR body, #593 and #595 will need their one-line type fixes once this lands.

[hivecommons-hive]

a458931

ℹ️ Sentinel notice — informational; author is trusted (hive agent), merge is not blocked

Hive flagged this PR (author @hivecommons-hive[bot], head a45893179dd3) because it matches behaviors that can override security controls, escalate privileges or damage the codebase. This is a heuristic, not an accusation — a maintainer should confirm the change is intended before it merges.

• sensitive_path — changes 2 sensitive path(s) (Touches a sensitive path (OWNERS, workflows, policies, hive config, security docs, …))
  • .github/workflows/test.yml
  • package.json

Hive did not add the sentinel-alert label because this author is trusted. The finding remains recorded for audit and the dashboard Security tab; set sentinel.trusted_authors_block: true to require the blocking label for trusted authors too.

[hivecommons-hive]

The approach is sound and most of the 29 fixes read correctly, but this PR cannot land as-is: its own new check fails on current main.

Verified by running it (merged pull/599/head onto origin/main, resolving the one conflict):

npx tsc -p tsconfig.test.json reports 3 errors:

• __tests__/issueCommentTest/meowImageEdges.test.ts:45 — TS2344 '"createComment"' does not satisfy the constraint 'never'
• __tests__/setup.ts:19 — TS7006 _super implicitly any
• __tests__/utils/configTypeGuards.test.ts:22 — TS2532 object possibly undefined

These are exactly the three the PR body predicted under "Still waiting on a human" for then-held #593 and #595 — both of which have since merged to main. The predicted one-line fixes now belong in this PR (or must land first), because the diff also adds - run: npm run typecheck to build-test in .github/workflows/test.yml, so CI would go red on the merge commit.

Body/diff mismatch worth fixing: the body says the enforcing CI step "cannot be pushed at this agent's token tier" and leaves it for a human via #170 — but the diff does contain the .github/workflows/test.yml hunk. Either the constraint lapsed or the hunk arrived later; either way the body misstates the diff, and a maintainer should be aware they are being asked to approve a bot-authored workflow edit (the step itself is benign: one run line, no permission changes).

Also: mergeable: CONFLICTING — only docs/contributing.md conflicts; code merges clean.

Asks: rebase, fix the three new type errors, and update the body to match the diff (workflow hunk included, #593/#595 no longer held). The tsconfig.test.json + npm run typecheck design itself looks right — extends the root config, noEmit, excludes the coverageEntry build that has its own tsconfig.

— hive: agent=reviewer backend=copilot model=claude-fable-5 copilot=1.0.88

[mrbobbytables]

Re-merged after #593/#595/#603 landed on main; applied the three type fixes the body predicted (meowImageEdges.test.ts:45, setup.ts:19, configTypeGuards.test.ts:22). npm run typecheck exits 0 again. The only failing unit test on this branch is the main breakage fixed by #617.

[hivecommons-hive]

2d9d1c0

ℹ️ Sentinel notice — informational; author is trusted (hive agent), merge is not blocked

Hive flagged this PR (author @hivecommons-hive[bot], head 2d9d1c0b3fe5) because it matches behaviors that can override security controls, escalate privileges or damage the codebase. This is a heuristic, not an accusation — a maintainer should confirm the change is intended before it merges.

• sensitive_path — changes 2 sensitive path(s) (Touches a sensitive path (OWNERS, workflows, policies, hive config, security docs, …))
  • .github/workflows/test.yml
  • package.json

Hive did not add the sentinel-alert label because this author is trusted. The finding remains recorded for audit and the dashboard Security tab; set sentinel.trusted_authors_block: true to require the blocking label for trusted authors too.

[hivecommons-hive]

bc5324c

ℹ️ Sentinel notice — informational; author is trusted (hive agent), merge is not blocked

Hive flagged this PR (author @hivecommons-hive[bot], head bc5324c79efd) because it matches behaviors that can override security controls, escalate privileges or damage the codebase. This is a heuristic, not an accusation — a maintainer should confirm the change is intended before it merges.

• sensitive_path — changes 2 sensitive path(s) (Touches a sensitive path (OWNERS, workflows, policies, hive config, security docs, …))
  • .github/workflows/test.yml
  • package.json

Hive did not add the sentinel-alert label because this author is trusted. The finding remains recorded for audit and the dashboard Security tab; set sentinel.trusted_authors_block: true to require the blocking label for trusted authors too.

[hivecommons-hive]

Decision needed: @jpmcb should confirm that the npm run typecheck CI step added to .github/workflows/test.yml on this branch via maintainer merge commits (a458931, c42c307, authored by Bob Killen) is intended to land with this PR, since the PR body still says the step is "waiting on a human".

The typecheck work itself checks out; one fact needs a maintainer's eyes because it touches CI.

Body ↔ diff mismatch (the reason for routing): the PR body says the enforcing step in .github/workflows/test.yml "cannot be pushed at this agent's token tier" and is still waiting on a human — but the diff does contain - run: npm run typecheck (test.yml:36, after npm run build). I traced it: the line entered only through merge commits a458931 and c42c307, both authored by Bob Killen (bkillen@linuxfoundation.org), so a maintainer added it to the branch and the body is simply stale. Since .github/workflows is a trust surface, confirming that was intentional is a human call; the step itself adds no permissions and runs an npm script defined in this same PR.

What I verified (at head bc5324c, fresh clone):

• npm run typecheck (tsc -p tsconfig.test.json) passes at the head, and still passes after merging current main@feed1ba.
• Plain main with this PR's tsconfig.test.json fails tsc with real errors (e.g. __tests__/worker/worker.test.ts:118,127,145,147 — UUID template-literal type violations), so the check is not vacuous and the fixes are needed.
• build-test CI (which runs the full vitest suite) is green, supporting the "no test semantics change" claim.

Stacking note: this branch contains #598 in full (its head 504e9b9 is an ancestor of bc5324c). Merging #599 first makes #598 a no-op; merging #598 first shrinks this PR to its own ~28-file delta. Both merge cleanly with current main.

— hive: agent=reviewer backend=copilot model=claude-fable-5 copilot=1.0.88