[hivecommons-hive]

Test Improvement

__tests__/runtime.test.ts — one new describe inside the existing action.yml runs the bundle under node24 block; no other file changes.

runtime.test.ts already holds engines.node, devEngines.runtime, @types/node, the README, docs/contributing.md and every setup-node step to the major of action.yml's runs.using, and its own comment says every other Node version in the repository must name the same major. .github/dependabot.yml ignores the Dockerfile's node major with the note that it is bumped together with action.yml. The Dockerfile — the runtime the server and the chart's CronJob actually run on — was the one pinned-together reference no test read, so a FROM node:26-slim on either stage, or the two stages drifting to different digests, rendered and shipped silently.

The new cases:

• both FROM lines name node:<runs.using major>-slim@sha256:<64 hex>;
• the build and runtime stages use one digest, so a dependabot docker bump cannot move one stage alone.

Verified red-before-green by hand: a node:26-slim runtime stage fails two cases (major + digest), a digest-only drift fails one; npx vitest run __tests__/runtime.test.ts at main@9aa12b8 passes 19/19; eslint and tsc -p tsconfig.test.json clean.

Disjoint from held #680–#689: none of them touch runtime.test.ts or the Dockerfile.

Related Issue

None — the finding is fully resolved by this diff, so no tracking issue was opened.

---

Filed by quality agent (hold-gated mode). Human review required.

— hive: agent=quality backend=copilot model=claude-fable-5.1

[hivecommons-hive]

Important

Held for human review by the hive's ACMM level gate.

This PR was opened by the "quality" agent while Hive policy required a human checkpoint for that agent. Agent PRs are held at ACMM L3–L5; an outreach PR that targets a repository this hive does not manage is held at every level because it publishes project-facing communication into someone else's project.

Hive will keep the hold label until a human removes it. Operators can make a deliberate one-off release during an ACMM level change with release_level_holds=true, but level changes never release this hold automatically.

[hivecommons-hive]

Hive status — updated in place; edits do not notify. Full history is in the Activity Monitor.

Reviewed by reviewer — no findings.

Reviewer notes

Read the tree at head 91b00ab, not just the diff. This looks correct to me.

Verified:

• Dockerfile:1 and Dockerfile:10 both read FROM node:24-slim@sha256:c86ecead… — one digest, build stage carries AS build — so the regex at __tests__/runtime.test.ts:81 (( AS \w+)?$) matches both lines as the tree stands, and the digest-equality case at line 84–87 passes.
• runtimeMajor is derived at runtime.test.ts:25 from action.yml runs.using: node24 (action.yml:31), so the new cases pin the Dockerfile to the same source of truth every other case in the file already uses.
• The body's claim about dependabot is accurate: .github/dependabot.yml:30-32 ignores the node docker major with the comment "bump them together" — this test is indeed the only thing that would notice drift.
• Ran npx vitest run __tests__/runtime.test.ts at head: 19/19 pass.

One observation, not a defect: stages is computed at module load (runtime.test.ts:75), so a missing Dockerfile would throw during collection rather than fail a named case — consistent with how action.yml/package.json are already read at the top of the file, so it follows the file's own convention.

No findings. A maintainer can take this at face value; the only open question is the repo's usual hold/needs-kind labeling, which is process, not code.

[hivecommons-hive]

/kind cleanup

---

🐝 Hive Agent: quality | Instance: hosted-available-lke648397-260827-5q9t | SHA: unknown

— hive: agent=quality backend=copilot model=claude-fable-5.1 copilot=1.0.88