Repository navigation
ci: run every suite that reads an authored tree on the document-only path - #2035
Merged
mrbobbytables merged 1 commit intoOct 31, 2026
Merged
Conversation
…path Five suites walk docs/, blog/, adr/ or CONTRIBUTING.md and were not on the focused list, so a document-only PR could ship an iframe the CSP blocks, a nested paragraph the build only warns about, an orphaned static asset or a false gate claim with every check green. Add them, and make the workflow guard scan tests/ for suites that read those trees so the next one fails here instead of being skipped silently. Fixes cncf#2030 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Signed-off-by: mrbobbytables <mrbobbytables@users.noreply.github.com>
✅ Deploy Preview for endusers ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
Contributor
|
[scanner] Verified locally against the PR head (baed624):
This is the fix for #2030 the hive could not push itself (workflow file, contributor-tier token) — thank you for landing it. LGTM from the scanner lane. 🐝 Hive Agent: — hive: agent=scanner backend=copilot model=kimi-k3 copilot=1.0.88 |
![hivecommons-hive[bot]](https://avatars.githubusercontent.com/in/3568013?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Read both halves against the tree at the PR head; the change is additive-only and the derivation logic holds up.
.github/workflows/ci.yml: theCheck content contractsstep gains five suites and loses none; nopermissions:, trigger, or job-level change anywhere in the diff. Each added suite really does read an authored tree (e.g.tests/static-orphans.test.mjsscansdocs/,blog/,adr/;tests/site-config.test.mjsreadsdocs/blog).tests/content-only-ci-workflow.test.mjs:64-79: the candidate scan requires both a repo-root resolution and an authored-tree token, which is what keeps it an over-approximation with a bounded false-positive set — and every false positive must be named inFULL_PATH_ONLYwith a reason, plus the stale-entry check at:146-150makes an exclusion die when the suite stops matching. The two-sided assertion (candidate not listed → fail; listed exclusion not a candidate → fail) closes the hole #2010/#2025 patched by hand.- One behavior to be aware of, not a defect: the focused step now runs the guard that audits the step itself (
tests/content-only-ci-workflow.test.mjsis both auditor and list member), so a future doc-reading suite fails the document-only path too, not just the full path. That is the point of the PR and it is consistent with ADR 0011's explicitly-maintained list.
No defects found. Because this edits a CI workflow — a trust surface — sign-off belongs to a human maintainer other than the author; flagging for that review rather than offering a bare "looks good". The facts above are what I verified.
— hive: agent=reviewer backend=copilot model=claude-fable-5 copilot=1.0.88
mrbobbytables
added a commit
to mrbobbytables/endusers
that referenced
this pull request
Oct 31, 2026
…ge lane The End-to-end coverage check requires every file under src/ to be measured in the browser and every source line to be covered. The events plugin lived in src/plugins/ but runs only in Node at build time, and the empty state, start-day-only calendar block and single-day and cross-year range text in EventsIndex and formatDateRange() are unreachable from the published event pages, which are all multi-day events within one month. - Move the plugin to scripts/lib/events-catalog-plugin.mjs beside the reader it wraps. - Split EventsIndex into a default export that reads the plugin data and a hook-free EventsCatalog that renders a years array, so a fixture page can hand it shapes the published catalog never holds. - Add tests/e2e/fixtures/docs/events-catalog.mdx and a coverage-gated spec that render the empty catalog and single-day, cross-month and cross-year events; register the spec with the describe-gate guard. - Accept formatDateRange's unparseable-date guard as a data-shape region; scripts/lib/events-catalog.mjs rejects such pages at build time. - Rebase onto cncf#2035 and move tests/events-index.test.mjs onto the focused document-only path instead of listing events-page.test.mjs in FULL_PATH_ONLY, so the two PRs no longer disagree about that suite. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Signed-off-by: mrbobbytables <mrbobbytables@users.noreply.github.com>
3 tasks done
mrbobbytables
added this pull request to the merge queue
Oct 31, 2026
mrbobbytables
added a commit
to mrbobbytables/endusers
that referenced
this pull request
Oct 31, 2026
…ge lane The End-to-end coverage check requires every file under src/ to be measured in the browser and every source line to be covered. The events plugin lived in src/plugins/ but runs only in Node at build time, and the empty state, start-day-only calendar block and single-day and cross-year range text in EventsIndex and formatDateRange() are unreachable from the published event pages, which are all multi-day events within one month. - Move the plugin to scripts/lib/events-catalog-plugin.mjs beside the reader it wraps. - Split EventsIndex into a default export that reads the plugin data and a hook-free EventsCatalog that renders a years array, so a fixture page can hand it shapes the published catalog never holds. - Add tests/e2e/fixtures/docs/events-catalog.mdx and a coverage-gated spec that render the empty catalog and single-day, cross-month and cross-year events; register the spec with the describe-gate guard. - Accept formatDateRange's unparseable-date guard as a data-shape region; scripts/lib/events-catalog.mjs rejects such pages at build time. - Rebase onto cncf#2035 and move tests/events-index.test.mjs onto the focused document-only path instead of listing events-page.test.mjs in FULL_PATH_ONLY, so the two PRs no longer disagree about that suite. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Signed-off-by: mrbobbytables <mrbobbytables@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Third instance of the class #2002 and #2018 named: the document-only path's
Check content contractsstep omitted suites that read the authored trees. On53e82aa:tests/site-config.test.mjsdocs,blogtests/mdx-paragraph-nesting.test.mjsdocs,blog<p>the production build only warns abouttests/mdx-components.test.mjsdocs,blogtests/static-orphans.test.mjsdocs,blog,adrstatic/assettests/content-only-ci-workflow.test.mjsCONTRIBUTING.mdAll five run standalone in 0.25s and need no build. The fifth was not in #2030; it fell out of the scan below.
Remit: a security exposure, a bypass of the content gates on the one CI path that handles authored content (ADR 0008 rule 1).
Root cause
tests/content-only-ci-workflow.test.mjsasserted a hardcoded subset was present, so it caught the removal of a named suite but never the omission of an unnamed one. #2010 and #2025 each added names. This PR makes the guard derive its candidates: everytests/*.test.mjswhose source resolves the repository root and namesdocs/,blog/,adr/or a root document must be on the focused list or in an explicitFULL_PATH_ONLYmap with the reason it stays off it (generateddocs/architectures/pages, the data-backed events page,blog/authors.yml, fixture-only matches). A stale exclusion fails as well. With the ci.yml half reverted, the guard reports exactly the five suites above.ADR 0011's rule that the list is maintained explicitly in the workflow still holds; the guard checks the list's completeness rather than replacing it.
Fixes #2030
Verification
node --test tests/content-only-ci-workflow.test.mjs: 4 pass; 3 pass / 1 fail naming the five suites with the ci.yml change revertedci.yml(473 tests) passesnpm run test:unit:coverage:check: 3813 pass, gate greencheck:format,check:lint(changed file),check:spelling,check:duplication(244/245, 37/37, unchanged) clean