Repository navigation
[ci-maintainer] path-filtered TypeScript & ESLint / Vitest checks can't be required — #300 merged with lint red, main broken 32 min #310
Description
CI Issue
main protection now requires only Lint and build (enforcement_level=non_admins, verified 2026-10-11T03:20Z via GET /repos/hivecommons/docs/branches/main). The other three PR checks cannot be required as the workflows stand:
TypeScript & ESLint(.github/workflows/typecheck.yml) andRun unit tests(.github/workflows/vitest.yml) carrypaths:filters, so they are skipped (no check-run at all) on PRs outside those paths — a required check that never reports blocks the merge forever, which is why [ci-maintainer] main requires 0 status checks (enforcement off) — missed in hive#9744 rollout; needs admin to require 'Lint and build' + 'Audit production dependencies' and un-block the daily refresh push #245 deliberately left them out.Audit production dependencies(.github/workflows/npm-audit.yml) has no path filter and could be required right now; it was recommended in [ci-maintainer] main requires 0 status checks (enforcement off) — missed in hive#9744 rollout; needs admin to require 'Lint and build' + 'Audit production dependencies' and un-block the daily refresh push #245 but not applied.
The consequence is that a PR with a red lint/test check merges as soon as Lint and build is green. This is not hypothetical:
Evidence
- PR docs: link release channels to the canonical stable-soak policy page #300 (head
931bbf8): check-runs on the head at 13:25:54Z —Lint and buildsuccess,Run unit testssuccess,TypeScript & ESLintfailure (prettier violation inscripts/sync-hive-docs.ts, run 38055682485 of the same workflow onscanner/fix-181rebased onto it failed identically). - The hive sweep commented
hive/awaiting-ci: CI pending — sweep will merge when greenat 13:26:03Z, thenapp/hivecommons-hivemerged docs: link release channels to the canonical stable-soak policy page #300 at 13:30:46Z with the lint check stillfailure. mainwent red:TypeScript & Lint Checkpush runs 38055999319 (f3f4566, 13:30Z) and 38057455196 (a9d2c34, 13:53Z) failed; PR chore: remove unused globe animation and its three.js dependencies #301 inherited the failure (run 38056749018). Fixed 14:02Z by chore: format sync-hive-docs.ts to satisfy prettier gate #302 (a139d1c). ~32 minutes of red main and one PR blocked on an unrelated diff.- [ci-maintainer] main requires 0 status checks (enforcement off) — missed in hive#9744 rollout; needs admin to require 'Lint and build' + 'Audit production dependencies' and un-block the daily refresh push #245 was auto-closed by
hive-close-on-mergeon 2026-10-09 while its task list still showed Step 1 outstanding (see its task-list-sweep comment: "1 of 2 items ticked").
Recommendation
A (recommended, this repo): drop the paths: filters so both workflows report on every PR and can be required. Cost measured on PR #309: TypeScript & ESLint 45s, Vitest 83s per PR.
.github/workflows/typecheck.yml — replace the whole on: block (lines 3–31) with:
on:
pull_request:
branches: [main]
push:
branches: [main].github/workflows/vitest.yml — replace the whole on: block (lines 3–25) with:
on:
pull_request:
branches: [main]
push:
branches: [main]Then, as org admin (the App token gets 403 on the protection endpoints):
gh api -X PATCH repos/hivecommons/docs/branches/main/protection/required_status_checks \
-f strict=false \
-f 'contexts[]=Lint and build' \
-f 'contexts[]=TypeScript & ESLint' \
-f 'contexts[]=Run unit tests' \
-f 'contexts[]=Audit production dependencies'B (alternative, hivecommons/hive): keep the path filters here and make the automerge sweep refuse to merge any head that has a completed/failure check-run, required or not. That is hive production source and out of this lane's scope; it is tracked separately on the hive side. A does not depend on B and closes the hole for this repo on its own.
Why issue-only, no PR: both edits are under .github/workflows/, which this agent's token tier cannot push (GitHub rejects workflow writes without the workflows permission), and the protection PATCH needs org-admin rights. A human or an ISSUES_PRS_MERGE-tier agent must land the workflow change; the PATCH is admin-only either way.
-
typecheck.ymlpaths:filters removed -
vitest.ymlpaths:filters removed -
mainrequiresLint and build,TypeScript & ESLint,Run unit tests,Audit production dependencies
Refs #245 (closed early by close-on-merge; this supersedes its outstanding Step 1).
Filed by ci-maintainer agent (ACMM L6 — full mode)
🐝 Hive Agent: ci-maintainer | Instance: hosted-available-oke-11-placeholder-r05x | SHA: c2fd2a9
— hive: agent=ci-maintainer backend=copilot model=claude-fable-5.1 copilot=1.0.88
Activity
hivecommons-hive commentedon Oct 11, 2026
What to reply
/hive approve: go with the recommendation/hive decision <your instructions>: go ahead, following your instructions/hive help: show these againIf this issue is waiting only for reporter confirmation after a merged fix, the reporter or a maintainer can reply
/fixedinstead.Only a maintainer with write access can un-park; everything else is ignored. Full command reference: https://github.com/hivecommons/hive/blob/v5/src/docs/maintainer-commands.md.
hivecommons-hive commentedon Oct 13, 2026
Folded finding. This was filed as a separate issue, but 1 open agent-filed issue (plus 9 closed as completed in the last 14 days) already cite
github/workflows/vitest.yml, so it was folded into the oldest of them instead of opening another. Treat this issue as the tracker for that component: prefer one structural fix that covers every folded variant over a PR per variant.[quality] rewriteLinks/rewriteLinkTarget image, protocol-relative and query branches untested in prebuild sync scripts
Finding
Type:
coverage-gapThe two prebuild sync scripts export link-rewriting helpers whose documented behaviours are not exercised by their unit suites:
scripts/sync-sibling-docs.tsrewriteLinks()— the docblock promises "relative image sources become raw.githubusercontent URLs", but thebranch (line 433) has zero statement coverage; the synced-route-without-anchor branch (line 436) and./-prefix stripping are also untested. Only three cases exist inscripts/sync-sibling-docs.test.ts.scripts/sync-hive-docs.tsrewriteLinkTarget()— the protocol-relative (//…), empty-target and lone-?queryskip branches (lines 171, 174, 177) are uncovered, as is?querysuffix preservation on a rewritten in-tree link.These helpers run on every
npm run build(prebuild) and shape every link on synced sibling/hive pages, so a regression there silently breaks published docs rather than failing a test.Evidence
npx vitest run --coverageat128d8b5(main) —sync-sibling-docs.ts98.97% stmts / 87.67% branches (uncovered: 433, 436, 479-511, 554);sync-hive-docs.ts95.12% stmts / 87.27% branches (uncovered: 171, 174, 177, 262)..github/workflows/vitest.yml) is the only coverage-producing suite in this repo;build.ymlruns prebuild against live upstream content but produces no coverage data, so no separate e2e coverage evidence exists to combine. Both helpers are implicitly exercised by prebuild on real content, so this is capped at priority 2 (unit-reachable, no measured e2e).Recommendation
Add unit cases to the two existing test files:
rewriteLinks: image → raw URL (project repo and per-file repo), image never routed to a docs route,./stripping, anchor-less synced route, case-insensitive match, absolute/anchor images untouched.rewriteLinkTarget://protocol-relative, empty/whitespace target, lone?query,?querypreserved on rewrite, untrimmed target returned on skip.Not addressable from tests without refactoring:
sync-hive-docs.ts:262(path-traversal refusal) is unreachable becausefilesis a module constant; leaving as-is.Priority
Filed by quality agent (ACMM L4/L6 — full mode)
🐝 Hive Agent:
quality| Instance:hosted-available-oke-11-placeholder-r05x| SHA:128d8b5— hive: agent=quality backend=copilot model=claude-fable-5.1
clubanderson commentedon Oct 13, 2026
Done (option A, as org admin).
1. Workflow change — #330 (
🌱 ci: run typecheck and vitest on every PR so they can be required checks), admin-squash-merged as c553506.paths:filters removed from bothtypecheck.ymlandvitest.yml. Verified: the merge commit c553506 touched only.github/workflows/*and still triggeredTypeScript & Lint CheckandVitestpush runs onmain(previously those paths were excluded).2. Branch protection —
Read-back:
typecheck.ymlpaths:filters removedvitest.ymlpaths:filters removedmainrequiresLint and build,TypeScript & ESLint,Run unit tests,Audit production dependencies