Skip to content

[ci-maintainer] path-filtered TypeScript & ESLint / Vitest checks can't be required — #300 merged with lint red, main broken 32 min #310

Closed

Description

@hivecommons-hive

CI Issue

main protection now requires only Lint and build (enforcement_level=non_admins, verified 2026-10-11T03:20Z via GET /repos/hivecommons/docs/branches/main). The other three PR checks cannot be required as the workflows stand:

The consequence is that a PR with a red lint/test check merges as soon as Lint and build is green. This is not hypothetical:

Evidence

Recommendation

A (recommended, this repo): drop the paths: filters so both workflows report on every PR and can be required. Cost measured on PR #309: TypeScript & ESLint 45s, Vitest 83s per PR.

.github/workflows/typecheck.yml — replace the whole on: block (lines 3–31) with:

on:
  pull_request:
    branches: [main]
  push:
    branches: [main]

.github/workflows/vitest.yml — replace the whole on: block (lines 3–25) with:

on:
  pull_request:
    branches: [main]
  push:
    branches: [main]

Then, as org admin (the App token gets 403 on the protection endpoints):

gh api -X PATCH repos/hivecommons/docs/branches/main/protection/required_status_checks \
  -f strict=false \
  -f 'contexts[]=Lint and build' \
  -f 'contexts[]=TypeScript & ESLint' \
  -f 'contexts[]=Run unit tests' \
  -f 'contexts[]=Audit production dependencies'

B (alternative, hivecommons/hive): keep the path filters here and make the automerge sweep refuse to merge any head that has a completed/failure check-run, required or not. That is hive production source and out of this lane's scope; it is tracked separately on the hive side. A does not depend on B and closes the hole for this repo on its own.

Why issue-only, no PR: both edits are under .github/workflows/, which this agent's token tier cannot push (GitHub rejects workflow writes without the workflows permission), and the protection PATCH needs org-admin rights. A human or an ISSUES_PRS_MERGE-tier agent must land the workflow change; the PATCH is admin-only either way.

  • typecheck.yml paths: filters removed
  • vitest.yml paths: filters removed
  • main requires Lint and build, TypeScript & ESLint, Run unit tests, Audit production dependencies

Refs #245 (closed early by close-on-merge; this supersedes its outstanding Step 1).


Filed by ci-maintainer agent (ACMM L6 — full mode)


🐝 Hive Agent: ci-maintainer | Instance: hosted-available-oke-11-placeholder-r05x | SHA: c2fd2a9

— hive: agent=ci-maintainer backend=copilot model=claude-fable-5.1 copilot=1.0.88

Activity

  1. hivecommons-hive commented on Oct 11, 2026

    @hivecommons-hive
    ContributorAuthor

    What to reply

    • /hive approve: go with the recommendation
    • /hive decision <your instructions>: go ahead, following your instructions
    • /hive help: show these again

    If this issue is waiting only for reporter confirmation after a merged fix, the reporter or a maintainer can reply /fixed instead.

    Only a maintainer with write access can un-park; everything else is ignored. Full command reference: https://github.com/hivecommons/hive/blob/v5/src/docs/maintainer-commands.md.

  2. hivecommons-hive commented on Oct 13, 2026

    @hivecommons-hive
    ContributorAuthor

    Folded finding. This was filed as a separate issue, but 1 open agent-filed issue (plus 9 closed as completed in the last 14 days) already cite github/workflows/vitest.yml, so it was folded into the oldest of them instead of opening another. Treat this issue as the tracker for that component: prefer one structural fix that covers every folded variant over a PR per variant.

    [quality] rewriteLinks/rewriteLinkTarget image, protocol-relative and query branches untested in prebuild sync scripts

    Finding

    Type: coverage-gap

    The two prebuild sync scripts export link-rewriting helpers whose documented behaviours are not exercised by their unit suites:

    • scripts/sync-sibling-docs.ts rewriteLinks() — the docblock promises "relative image sources become raw.githubusercontent URLs", but the ![…](…) branch (line 433) has zero statement coverage; the synced-route-without-anchor branch (line 436) and ./-prefix stripping are also untested. Only three cases exist in scripts/sync-sibling-docs.test.ts.
    • scripts/sync-hive-docs.ts rewriteLinkTarget() — the protocol-relative (//…), empty-target and lone-?query skip branches (lines 171, 174, 177) are uncovered, as is ?query suffix preservation on a rewritten in-tree link.

    These helpers run on every npm run build (prebuild) and shape every link on synced sibling/hive pages, so a regression there silently breaks published docs rather than failing a test.

    Evidence

    • Unit: npx vitest run --coverage at 128d8b5 (main) — sync-sibling-docs.ts 98.97% stmts / 87.67% branches (uncovered: 433, 436, 479-511, 554); sync-hive-docs.ts 95.12% stmts / 87.27% branches (uncovered: 171, 174, 177, 262).
    • End-to-end: the Vitest workflow (.github/workflows/vitest.yml) is the only coverage-producing suite in this repo; build.yml runs prebuild against live upstream content but produces no coverage data, so no separate e2e coverage evidence exists to combine. Both helpers are implicitly exercised by prebuild on real content, so this is capped at priority 2 (unit-reachable, no measured e2e).

    Recommendation

    Add unit cases to the two existing test files:

    • rewriteLinks: image → raw URL (project repo and per-file repo), image never routed to a docs route, ./ stripping, anchor-less synced route, case-insensitive match, absolute/anchor images untouched.
    • rewriteLinkTarget: // protocol-relative, empty/whitespace target, lone ?query, ?query preserved on rewrite, untrimmed target returned on skip.

    Not addressable from tests without refactoring: sync-hive-docs.ts:262 (path-traversal refusal) is unreachable because files is a module constant; leaving as-is.

    Priority

    • Impact: medium
    • Effort: low

    Filed by quality agent (ACMM L4/L6 — full mode)


    🐝 Hive Agent: quality | Instance: hosted-available-oke-11-placeholder-r05x | SHA: 128d8b5

    — hive: agent=quality backend=copilot model=claude-fable-5.1

  3. clubanderson commented on Oct 13, 2026

    @clubanderson
    Member

    Done (option A, as org admin).

    1. Workflow change — #330 (🌱 ci: run typecheck and vitest on every PR so they can be required checks), admin-squash-merged as c553506. paths: filters removed from both typecheck.yml and vitest.yml. Verified: the merge commit c553506 touched only .github/workflows/* and still triggered TypeScript & Lint Check and Vitest push runs on main (previously those paths were excluded).

    2. Branch protection —

    gh api -X PATCH repos/hivecommons/docs/branches/main/protection/required_status_checks --input - <<'JSON'
    {"strict": false, "checks": [
      {"context": "Lint and build", "app_id": 15368},
      {"context": "TypeScript & ESLint", "app_id": 15368},
      {"context": "Run unit tests", "app_id": 15368},
      {"context": "Audit production dependencies", "app_id": 15368}
    ]}
    JSON
    

    Read-back:

    $ gh api repos/hivecommons/docs/branches/main/protection/required_status_checks --jq '{strict,contexts}'
    {"contexts":["Lint and build","TypeScript & ESLint","Run unit tests","Audit production dependencies"],"strict":false}
    
    • typecheck.yml paths: filters removed
    • vitest.yml paths: filters removed
    • main requires Lint and build, TypeScript & ESLint, Run unit tests, Audit production dependencies
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    agent/ci-maintainerCreated by Hive for agent-filed issue provenanceciCreated by Hive for agent-filed issue provenance

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions