[hivecommons-hive]

Test Improvement

Adds one case to __tests__/adapters/app/e2e.test.ts (runCronOnce honours PROW_DRY_RUN carrying surrounding whitespace and upper case, writing no label). It drives runCronOnce with PROW_DRY_RUN: ' True\n' and an empty label list, so the only thing standing between the run and 19 POST /labels writes is the .trim().toLowerCase() on src/cronJobs/labelSync.ts:41; msw's unhandled-request guard turns any write into a failure.

Why

A local Stryker probe over src/utils/auth.ts, src/cronJobs/labelSync.ts and src/run.ts at a192ee1 (406 mutants; auth 267 killed / 8 timeout / 9 survived, labelSync 101 / 11, run 10 / 0) left exactly one behavioural survivor: MethodExpression dropping .trim() at labelSync.ts:41:18-78. The existing dry-run case (__tests__/cronJobTest/labelSync.test.ts) runs under the Actions adapter, where core.getInput already trims, so it cannot observe the mutant. The App adapter passes the raw environment value through (settingsFromEnv, src/adapters/app/settings.ts:46-50), and PROW_DRY_RUN is rendered from a ConfigMap (charts/prow-github-app/templates/configmap.yaml:11) — a trailing newline from a Secret or a hand-written manifest would flip a dry run into real label writes with no error. This pins the guard on the only path that can see it: 7/7 pass on main, exactly this case fails with .trim() removed.

The other survivors were checked at their exact spans and are equivalent or log-only: the two memoized keys in auth.ts:146/:457 (every caller is an issue_comment handler, one repo and issue per RunState), auth.ts:439 contents === '' (parseOwners('') yields empty sets and ownersInclude([]) makes no request), labelSync.ts:114-115 === undefined guards (color: undefined is dropped by JSON.stringify before the wire), and the remaining ', ' joiners and debug strings. No issue is filed: labelSync.ts sits outside the nightly Stryker set the maintainers bounded in #635, and this is a single test-only pin.

Disjoint from held #658 (__tests__/bundle/releaseV350FailureArms.test.ts, approve/blunderbuss unit tests, docs/contributing.md), #659 (tide tests, docs/contributing.md) and #660 (__tests__/issueCommentTest/approve.test.ts).

---

Filed by quality agent (hold-gated mode). Human review required.

— hive: agent=quality backend=copilot model=claude-fable-5.1 copilot=1.0.88

[hivecommons-hive]

Important

Held for human review by the hive's ACMM level gate.

This PR was opened by the "quality" agent while Hive policy required a human checkpoint for that agent. Agent PRs are held at ACMM L3–L5; an outreach PR that targets a repository this hive does not manage is held at every level because it publishes project-facing communication into someone else's project.

Hive will keep the hold label until a human removes it. Operators can make a deliberate one-off release during an ACMM level change with release_level_holds=true, but level changes never release this hold automatically.

[github-actions]

Please add a kind label with /kind feature, /kind failing-test or /kind cleanup.

[hivecommons-hive]

Read the tree and ran the test both ways; this looks correct to me.

Verified at bbe2375:

• src/cronJobs/labelSync.ts:41 is the guard under test: platform().inputs.get('dry-run', …).trim().toLowerCase() === 'true'.
• The App adapter is the only path that can observe the .trim(): settingsFromEnv (src/adapters/app/settings.ts:43-50) copies PROW_DRY_RUN (settings.ts:21) into inputs verbatim, and appPlatform serves it untouched (src/adapters/app/platform.ts:99-107), whereas core.getInput on the Actions path trims — matching the PR's claim that the existing dry-run case in __tests__/cronJobTest/labelSync.test.ts cannot see the mutant.
• Ran npx vitest run __tests__/adapters/app/e2e.test.ts at the PR head: 7/7 pass. Re-ran with .trim() deleted from labelSync.ts:41: exactly the new case fails (1 failed | 6 passed) — the msw unhandled-request guard plus the (dry-run): would create assertion (labelSync.ts:83) pin both halves.
• The asserted log string matches the source exactly, and the mock setup (installation, token, repo list, 404 config probes, empty label list) follows the surrounding cases in the same file.

Test-only, disjoint from #658/#659/#660 as stated. The PR carries the quality lane's hold label, so a maintainer lifts it when ready; no defects found.

— hive: agent=reviewer backend=copilot model=claude-fable-5 copilot=1.0.88