[hivecommons-hive]

Test Improvement

Three tests in two existing files, pinning the five behavioural survivors of a Stryker pass over the four src/ modules no earlier probe had covered (adapters/app/settings.ts, cronJobs/handleCronJob.ts, cronJobs/labelSync.ts, utils/octokit.ts: 200 mutants, 186 killed, 14 survived; the other nine are equivalent or change only an info log's separator):

• __tests__/cronJobTest/labelSync.test.ts — names every refused label with its reason, comma-separated, when several writes fail: two 422s, asserting the whole setFailed message (2 label(s) could not be synced: kind/bug (…), lgtm (…)) and the running label-sync job debug line (labelSync.ts:90, handleCronJob.ts:31; the existing case provokes one failure so the separator was never exercised, and sweep.test.ts:730 pins the sibling debug lines for sweep and lgtm only).
• __tests__/cronJobTest/labelSync.test.ts — names each configuration source the labels came from, comma-separated: an org-level and a repo-level prow.yaml, asserting the debug line names both (labelSync.ts:45, both the sources.length === 0 arm and the join(', ')).
• __tests__/adapters/app/platform.test.ts — trims the newlines and spaces a secret file or heredoc leaves around the key: settingsFromEnv with a key wrapped in \n/spaces, expecting the trimmed, \n-unescaped PEM (settings.ts:40, the .trim() the docstring and docs/github-app.md promise).

No production code changes. Verified at 9aa12b8: each of the five mutations applied by hand makes exactly one of these tests fail; restored, 36/36 pass in the two files; eslint and tsc -p tsconfig.test.json clean.

Why these and not the equivalent ones: { required: false } → {} is the input getter's default, /\s+/ → /\s/ is hidden by the filter(c => c !== '') that follows, and createLabel's color/description spreads serialise identically because JSON drops undefined.

Related Issue

Refs #682 — this lands the settings/labelSync survivor finding the hive folded into that issue; the issue's primary finding (the v8-ignore hint guard under Stryker's sandbox) remains open and is carried by #683.

Occupied-ground check: touches only __tests__/cronJobTest/labelSync.test.ts and __tests__/adapters/app/platform.test.ts; held #681 touches cron.test.ts/redis.test.ts/stores.test.ts, #685 sweepDelayGuards.test.ts, and none of #680–#688 touch either file.

---

Filed by quality agent (hold-gated mode). Human review required.

— hive: agent=quality backend=copilot model=claude-fable-5.1

[hivecommons-hive]

Important

Held for human review by the hive's ACMM level gate.

This PR was opened by the "quality" agent while Hive policy required a human checkpoint for that agent. Agent PRs are held at ACMM L3–L5; an outreach PR that targets a repository this hive does not manage is held at every level because it publishes project-facing communication into someone else's project.

Hive will keep the hold label until a human removes it. Operators can make a deliberate one-off release during an ACMM level change with release_level_holds=true, but level changes never release this hold automatically.

[hivecommons-hive]

bfaaaf1

ℹ️ Sentinel notice — informational; author is trusted (hive agent), merge is not blocked

Hive flagged this PR (author @hivecommons-hive[bot], head bfaaaf1cec53) because it matches behaviors that can override security controls, escalate privileges or damage the codebase. This is a heuristic, not an accusation — a maintainer should confirm the change is intended before it merges.

• remote_code_execution — adds a remote-fetch-and-execute, decoded payload, reverse shell or embedded credential (Adds curl|sh, eval of encoded payloads, reverse shells or embedded private keys)
  • __tests__/adapters/app/platform.test.ts

Hive did not add the sentinel-alert label because this author is trusted. The finding remains recorded for audit and the dashboard Security tab; set sentinel.trusted_authors_block: true to require the blocking label for trusted authors too.

[hivecommons-hive]

Hive status — updated in place; edits do not notify. Full history is in the Activity Monitor.

Reviewed by reviewer — no findings.

Reviewer notes

Read the sources, not just the diff; this looks correct to me.

Verified against the tree at bfaaaf1:

• The multi-failure test pins real behaviour: src/cronJobs/labelSync.ts:93-96 joins failures.map(f => ${f.name} (${f.message})) with ', ', and the pre-existing case (labelSync.test.ts:244) only ever provoked one failure, so the separator and list shape were previously unexercised. I applied the join(', ') → join('; ') mutant by hand: exactly the new test fails, 16/17 others pass.
• The sources test matches labelSync.ts:45 — config.sources.join(', ') — and the tier order in src/utils/config.ts:239-241 (org/base tier first, repo tier second) matches the asserted Codertocat/.github:prow.yaml, Codertocat/Hello-World:.github/prow.yaml order. The comment about registering the org handler after serveConfig() is right: msw runtime handlers take precedence over earlier ones.
• The key-trim test matches src/adapters/app/settings.ts:39-41 (replace(/\\n/g, '\n').trim(), replace before trim), reached via settingsFromEnv at settings.ts:54.

Both files pass as a whole: 36/36 locally, CI green. Test-only change, no production code touched, and the occupied-ground claim holds — no other open quality PR touches these two files. The Refs #682 non-closing link is justified on its face: the issue's primary finding is carried by #683.

No findings.

[hivecommons-hive]

/kind cleanup

---

🐝 Hive Agent: quality | Instance: hosted-available-lke648397-260827-5q9t | SHA: unknown

— hive: agent=quality backend=copilot model=claude-fable-5.1 copilot=1.0.88