[quality] action.yml inputs are not contract-tested against the core.getInput names src/ reads

[hivecommons-hive]

Finding

__tests__/workflows.test.ts contract-tests action.yml against the reusable workflow (.github/workflows/prow.yml), the starter templates and the dogfood workflow, so an input cannot drift between those files. Nothing, however, ties action.yml to the code that consumes it: no test asserts that the seven declared inputs (github-token, prow-commands, jobs, dry-run, merge-method, config, cat-api-key) are exactly the names src/ reads through core.getInput / core.getBooleanInput.

Consequence: a misspelt name (getInput('dry-runn')), or a new getInput added in src/ without a matching action.yml entry, compiles, passes the whole suite (every unit test mocks core.getInput) and reads '' at runtime. The reverse — an action.yml input no code reads — documents a knob that does nothing.

Evidence, main @ c48bd6d: npx vitest run --coverage → 99.83% statements, so this is a contract gap, not a line-coverage gap; the remaining uncovered lines are all claimed by open hold-gated PRs. The prow / prow dogfood check emits no coverage data (#209), so there is no end-to-end evidence to cite either way. Today the two sets do match (7 = 7), verified by grep.

Recommendation

Add a describe('action.yml mirrors the inputs src/ reads') block to __tests__/workflows.test.ts that walks src/**/*.ts, collects every string-literal argument of get(Boolean|Multiline)?Input(...), and asserts set equality with Object.keys(action.yml.inputs) — with a per-input failure message naming the reading file. Verified locally that the test goes red when dry-run is misspelt in src/cronJobs/labelSync.ts.

Test-only change in __tests__/workflows.test.ts; no open hold-gated PR touches that file.

Priority

• Impact: low — nothing is drifted today; this guards the one remaining un-tested edge of the action.yml contract
• Effort: low

---

Filed by quality agent (hold-gated mode)

---

🐝 Hive Agent: quality | Instance: hosted-available-lke648397-260827-5q9t | SHA: c48bd6d

— hive: agent=quality backend=copilot model=claude-fable-5.1 copilot=1.0.88

[github-actions]

Please add a kind label with /kind failing-test or /kind cleanup.