Repository navigation
🐝 Hive Advisory Report #170
Description
Activity
🐝 Advisory Digest — 2026-10-11 23:55 EDT
Automated code review findings from Hive agents. Each finding includes a file reference and suggested fix. This comment is updated periodically.
Advice
Frozen for governor mode
IDLEuntil 2026-10-18 (next review in 7 day(s)). The list of recommendations is frozen; their numbers, items and links are recomputed on every digest.Counts quoted: governor actionable queue 0 PRs / 1 issues (what mode and cadence key on; excludes held, draft, in-review and human-gated items) — Overview chart 2 open PRs / 1 open issues (every open or held item across repo cards; the queue-health advice counts these).
- Give idle agents a cadence — At least one enabled agent has no governor cadence, so it cannot be kicked automatically while the hive is quiet. (signals: mode=IDLE, no_cadence_agents=1)
Findings: 10
💡 Showing top 10 findings (by severity). 178 more exist. Set
governor.advisory.show_all: trueto see all.Severity Count 🟠 high 10 🟠 HIGH (10)
- [advisory] prow-github-actions#440: push-repacked-dist fails — Dependabot secrets REPACK_APP_ID/REPACK_APP_PRIVATE_KEY never configured after ci: repack dist/ on dependabot branches without exposing a write token #390; bundled-dep dependabot bumps still red on dist/ gate
.github/workflows/test.ymlqualityRun 38068101038 on chore(deps): bump js-yaml from 5.4.2 to 5.4.3 in the production-dependencies group #440: repack-dist success (changed=true), push-repacked-dist fails at create-github-app-token: app-id empty (Secret source: Dependabot). REPACK_APP_ID/REPACK_APP_PRIVATE_KEY Dependabot secrets from ci: repack dist/ on dependabot branches without exposing a write token #390 never configured. Maintainer-only fix; recorded on [quality] config.ts:305 — the explicit
configsource'snot foundarm is never driven through dist/index.js #422 fold comment + PR 440 comment. - [advisory] 0-byte OWNERS file fails every OWNERS-reading run: decode treats content '' as missing (owners.ts:163, auth.ts:493)
src/utils/owners.tsqualityGitHub returns an empty blob as content:'' encoding:'base64' (verified: gh api repos/cncf/prow-github-actions/git/blobs/e69de29...). decode() in owners.ts:163 and retrieveOwnersFile in auth.ts:493 test !content, so a 0-byte OWNERS file fails /approve, /lgtm and the OWNERS plugins with 'invalid OWNERS file returned from GitHub API' instead of parsing as nobody-listed. Unit tests pin only the missing-key shape (ownersAuth.test.ts:296, auth.test.ts:362). Filed cncf/prow-github-actions#404 for a maintainer (production fix).
- [advisory] prow-github-actions: comment-only prow.yaml throws YAMLException (js-yaml 5 zero-document input) instead of loading as an empty config
src/utils/config.tsqualityjs-yaml ^5.4.2 load() throws 'expected a document, but the input is empty' on zero-document input; parseProwConfig's text.trim()==='' guard (added feat(config): tiered prow.yaml configuration from org .project/.github, an explicit source, and the repo #144) rescues blank/whitespace but not comment-only files, so a '# comment' prow.yaml (repo or org tier) fails every label command with a YAMLException instead of loading as {}. Verified through dist/index.js on main@aa6a0f8. Unit cases cover '', '---', whitespace only. Issue filed with fix options; production change, maintainer PR.
- [advisory] test.yml never runs build-test on main after a tide (github.token) merge; main@3fc21f2 is red but unmeasured — needs workflow_dispatch + schedule ([quality] test.yml never runs on main after a tide merge — github.token merges don't trigger push; add workflow_dispatch + schedule #329)
.github/workflows/test.ymlqualitytest.yml is on:[push,pull_request] only; tide merges via github.token so no push run fires. main has no build-test run after a270568; main@3fc21f2 reproduces the [shared-ci] build-test failing across cncf/prow-github-actions #294 meow unhandled error locally. Fix needs workflows permission: add workflow_dispatch + schedule (issue [quality] test.yml never runs on main after a tide merge — github.token merges don't trigger push; add workflow_dispatch + schedule #329).
- [advisory] prow-github-actions: build-test red on test(bundle): drive the approve.github_review refusals, short-circuits and failures through dist/index.js #286/test(bundle): drive the tide merge gate's missing_labels block and labelMatch wildcards through dist/index.js #289/test(bundle): drive the configured hold and sweep sections through dist/index.js #293 from shared meow.test.ts passthrough flake; incident [shared-ci] build-test failing across cncf/prow-github-actions #294, fix held in test(meow): keep the unit /meow suite off the real network under msw 3 #287
__tests__/issueCommentTest/meow.test.ts⚠️ (not re-reported within the staleness window — still open, but not recently verified) quality - …plus 3 more [advisory] findings from quality, collapsed to keep lower-severity sections within GitHub's comment limit
- [coverage-gap] approve plugin: listComments/listReviews/updateComment error throws, no-base-ref repoHasOwners fallback, unknown event kind and uncoverable-file ordering untested
src/plugins/approve.ts⚠️ (not re-reported within the staleness window — still open, but not recently verified) qualityUnit evidence: npx vitest run --coverage (v8) on origin/main 187c5e3 leaves src/plugins/approve.ts at 96.92% stmts / 95.65% branches; uncovered: effectiveKind default (L227), uncoverable-file sort comparator (L345), updateComment catch (L409), listComments catch (L422), listReviews catch (L431), repoHasOwners fallback when base.ref is absent (L480-481), 'nobody approves anything' (L374), labeled with no label (L449). End-to-end evidence: the bundle acceptance harness tests/bundle/bundle.test.ts (runs dist/index.js against a fake GitHub; same revision, same vitest run) only exercises /approve and /approve cancel happy paths (bundle.test.ts:548-640); it never returns 5xx on comments/reviews/updateComment nor omits base.ref. Bundle coverage cannot be merged with the src/ v8 profile because ncc bundles dist/ without a src source map, so the two sources were analyzed separately. Fix: tests/plugins/approveErrorPaths.test.ts (8 tests) brings approve.ts to 100% stmts/lines/funcs.
- [regression-risk] msw 3 bump (chore(deps-dev): bump msw from 2.15.0 to 3.0.1 #278) fails 6 tests and silently disables onUnhandledRequest enforcement across the suite
__tests__/testUtils.ts⚠️ (not re-reported within the staleness window — still open, but not recently verified) qualitydependabot chore(deps-dev): bump msw from 2.15.0 to 3.0.1 #278 (msw 2.15.0 -> 3.0.1) fails build-test: 6 tests red (assign/cc multi-user order via Promise.all+push; configLoader org-500 test leaks its parallel repo-tier probe chain into the next test; HttpResponse.error() now 'fetch failed' not 'Failed to fetch'). Worse, msw 3 renamed onUnhandledRequest -> onUnhandledFrame, so all 55 server.listen({ onUnhandledRequest: 'error' }) calls are ignored and unhandled requests pass through to the real network (CI's unhandled POST /graphql hit api.github.com and got a 401). Reproduced main@a270568 with msw@3.0.1 on Node 24.21.0: 6 failed with egress, 141 timeouts without. Fix is tests-only.
☑️ Recently Closed — Fix Not Verified (10)
Closed on an agent's word or a hive heuristic (a merged PR's title matching the finding, or the issues/PRs it cites closing). The hive did not re-check the condition, so it may still hold.
- push-repacked-dist job fails on Dependabot PRs: REPACK_APP_ID/REPACK_APP_PRIVATE_KEY are Actions secrets, not exposed to dependabot-actor pull_request runs
test.yml push-repacked-dist (run 38068101038, PR #440)ci-maintainer — closed Oct 12 (no evidence recorded), fix not verified - prow-github-actions#440: push-repacked-dist job fails — REPACK_APP_ID/REPACK_APP_PRIVATE_KEY secrets still not provisioned, blocking all dependabot dist-bump PRs #440 scanner — closed Oct 12 (the issues/PRs it cites closed), fix not verified
- prow-github-actions#386: 14 commenter-auth catch wrappers are dead code — checkOrgMember/checkCollaborator/checkIssueComments never reject #386 scanner — closed Oct 12 (the issues/PRs it cites closed), fix not verified
- prow-github-actions#449: PR correctly removes 14 dead catch wrappers flagged in [quality] 14 commenter-auth catch arms (10 commands + auth.ts:181/210/217/224) are unreachable — only module mocks in unit tests keep them covered #386, tests pass, call-sites simplified #449 scanner — closed Oct 12 (the issues/PRs it cites closed), fix not verified
- prow-github-actions#40: No live end-to-end test harness — all coverage is msw-mocked unit tests #40 scanner — closed Oct 11 (the issues/PRs it cites closed), fix not verified
- prow-github-actions#443: actions/upload-artifact 7.0.1->7.0.2 SHA pin bump — only used in test.yml, low risk #443 scanner — closed Oct 11 (the issues/PRs it cites closed), fix not verified
- prow-github-actions#442: actions/setup-node 7.0.0->7.0.1 SHA pin bump — workflow-only, no dist/drift exposure #442 scanner — closed Oct 11 (the issues/PRs it cites closed), fix not verified
- prow-github-actions#441: dev-dependencies group bump touches only devDependencies — no dist/ drift risk #441 scanner — closed Oct 11 (the issues/PRs it cites closed), fix not verified
- prow-github-actions#424: ncc's cheap-module-source-map strips columns, so test:coverage:e2e misreports 3+ real hits as 0 on multi-expr lines #424 scanner — closed Oct 11 (the issues/PRs it cites closed), fix not verified
- onPrLgtm error paths + handlePullReq lgtm .catch now covered by unit tests; PR blocked: App token has no push to cncf/prow-github-actions
src/pullReq/onPrLgtm.tsquality — closed Sep 28 (the issues/PRs it cites closed), fix not verified
Analyzed at
cncf/prow-github-actions@7a5872e4e1e3(branchmain) — the latest commit when this digest was generated. File references that no longer exist at this commit are flagged as outdated. Findings marked⚠️ were computed at an older commit and have NOT been re-verified here./kind cleanup
This issue collects advisory findings from Hive agents.
At lower ACMM levels, some agents work in advisory mode — they analyze code and post findings here but do not create issues or PRs. At higher levels, designated agents (e.g. quality) can open issues and PRs directly, while other agents remain advisory-only.
The governor posts periodic digest comments summarizing what advisory agents found.
Do not close this issue. It is a living document.
— hive: agent=governor