[governor] 🐝 Hive Advisory Report #388

Activity

1. hivecommons-hive commented on Nov 10, 2026

   

   hivecommons-hiveBot

   on Nov 10, 2026 – with hivecommons-hive

   Last edited by hivecommons-hive

   ContributorAuthor

   More actions

   🐝 Advisory Digest — 2026-11-13 03:43 EST

   Automated code review findings from Hive agents. Each finding includes a file reference and suggested fix. This comment is updated periodically.

   Advice

   Frozen for governor mode QUIET until 2026-11-19 (next review in 7 day(s)). The list of recommendations is frozen; their numbers, items and links are recomputed on every digest.

   Counts quoted: governor actionable queue 2 PRs / 5 issues (what mode and cadence key on; excludes held, draft, in-review and human-gated items) — Overview chart 4 open PRs / 34 open issues (every open or held item across repo cards; the queue-health advice counts these).

   • Reduce the blocked PR queue — 2 of 4 open PRs (50%) are Blocked. 2 of 2 have merge conflicts — rebase or close the oldest. (signals: overview_open_prs=4, blocked=2, blocked_pct=50, failing_ci=0, merge_conflict=2, verdict_blocked=2, stale_blocked=0, oldest_blocked_days=32, top_repo=techdocs (2, 100%), top_author=iRaindrop (2, 100%))
     • First: techdocs#385 (merge conflict; verdict blocked: behind main — needs an update from the base branch; also an approving review is required by branch protection (0 given)), techdocs#386 (merge conflict; verdict blocked: blocked — an approving review is required by branch protection (0 given))
     • Full list: Blocked PRs (CSV), Blocked PRs in techdocs (CSV)
   • Clear the human gate on PRs — 2 of 4 open PRs (50%) wait on a human: 2 held, 0 labelled needs-human, 0 needs-decision — release, review, or close them. (signals: overview_open_prs=4, needs_human=2, held=2, needs_human_label=0, needs_decision=0)
     • First: techdocs#404 (held), techdocs#405 (held)
     • Full list: Needs-human PRs (CSV)

   Bands named above (same rules as the Overview chart):

   • Blocked (PRs): blocked sweep verdict, merge conflicts, or failing CI — read the verdict, rebase, or fix the checks
   • Needs human (PRs): held, or labelled needs-human, stage/085-needs-decision, needs-decision, 2-discussing, blocked, stage/045-needs-decision, epic, needs-triage — a human must review, decide, or release the hold before automation continues

   Findings: 10

   💡 Showing top 10 findings (by severity). 35 more exist. Set governor.advisory.show_all: true to see all.

   Severity	Count
   🔴 critical	1
   🟠 high	7
   🟡 medium	2

   🔴 CRITICAL (1)

   • [security] techdocs#395: Hive Commons assessment request asks for deliverables to land in hivecommons/hive & hivecommons.github.io — both outside the techdocs authorized-repo scope, and hivecommons/hive contains the Hive agent framework's own src/docs (agent-configuration, design, env-vars) #395 scanner

     Issue [Assessment request]: Hive Commons (pilot of the AI-assisted assessment workflow) #395 requests an in-scope techdocs assessment of 'Hive Commons' (hivecommons.dev) but explicitly scopes the 'other repositories in scope' to include https://github.com/hivecommons/hive 'src/docs/ (in-repo reference docs: api-reference, design, env-vars, agent-configuration)' and asks that 'assessment deliverables (findings, implementation PRs) should land as PRs in hivecommons/docs (primary) and hivecommons/hivecommons.github.io'. None of hivecommons/docs, hivecommons/hivecommons.github.io, or hivecommons/hive appear in this scanner's AUTHORIZED REPOS list (cncf/techdocs only). The issue also names a specific marketplace workflow id ('cncf-techdocs-assessment@curated-2026.11.1') and frames itself as the 'first end-to-end test case' for an 'intake -> accept -> draft -> verify -> stakeholder review -> approval loop', which reads as an attempt to get an agent to self-assess/modify the very agent framework (hive) that runs it, and to push code to repos outside the authorized scope. This is exactly the out-of-scope-repo pattern the operating rules forbid (ONLY cncf/techdocs is authorized); honoring the issue as written would require cloning and editing a non-authorized repo and opening PRs there.

   🟠 HIGH (7)

   • [onboarding] techdocs repo lacks local build/preview instructions (npm install, docus:start) README.md guide

     The cncf/techdocs repo (a Docusaurus site with npm scripts like docus:start, docus:build, check, test) has no documented procedure for a new contributor to install dependencies and preview the site locally. README.md and docs/index.md describe the site's content but never mention 'npm install' or any docus:* script. docs/repo-setup.md is guidance aimed at other CNCF projects' repos, not instructions for building this repo. CI workflows (.github/workflows/.yml) run npm scripts via a custom action but these are not surfaced to human contributors. Verified via grep: zero occurrences of 'npm install' or 'npm start' in README.md or docs/.md.

   • [coverage-gap] cncf/techdocs docusaurus.config.ts markdown.preprocessor regex-rewrite has zero test coverage (file path not found at analyzed commit — finding may be outdated) (reported 2×) quality

     markdown.preprocessor (docusaurus.config.ts:44-50) runs a regex rewrite (strips .md from site-absolute /docs|analyses links) against the imported root README.md. Unit evidence: lib/**/*.test.mts (node --experimental-strip-types --test) has no test file for docusaurus.config.ts; function is untested. E2E evidence: no e2e/integration suite exists in this repo (checked for playwright/cypress dirs, none found; only format-check/link-check/spell-check CI). Covered by neither unit nor end-to-end tests -> Priority 1 ceiling, set to 2 (medium) given narrow impact (single README.md import path). Provenance: cncf/techdocs main@4b1f800, checked 2026-11-12. Root cause: logic is inlined in docusaurus.config.ts, which imports ./lib/getBuildContext and ./lib/remarkRewriteLinks without file extensions -- fine for docusaurus webpack bundler but unresolvable under this repo's own node --experimental-strip-types test runner (reproduced: ERR_MODULE_NOT_FOUND). Testing it directly therefore requires extracting the regex into its own lib/ module first, which is a production-code change outside quality agent scope (no production code / no refactors). Filed as issue-only; no PR possible without that extraction.

   • [coverage-gap] lib/remarkRewriteLinks/index.ts: 4 branches uncovered by unit tests (89.74% branch coverage) lib/remarkRewriteLinks/index.ts quality

     rewriteHref() in lib/remarkRewriteLinks/index.ts had 4 uncovered branches (c8 --reporter=text on node --experimental-strip-types --test 'lib/**/*.test.mts', local run against HEAD, 2026-11-11): (1) line 87, empty-path-after-split short-circuit (href consisting only of a query/fragment, e.g. '?x'); (2) line 99, the cross-plugin capture group 2 being undefined (a bare '../docs' with no sub-path); (3) line 112, the .mdx branch of the site-absolute strip-extension ternary; (4) line 140, file.path being undefined in the remark plugin wrapper. Repo has no end-to-end/integration suite (CI only runs format-check.yml, link-check.yml, spell-check.yml per [quality] npm run test:unit never runs in CI — unit tests have no CI signal #390), so these branches were covered by neither unit nor end-to-end tests -> Priority 1.

   • [coverage-gap] cncf/techdocs lib/ build-context helpers (getBuildContext, getCurrentBranch, getGitHubRepoUrl) had no unit tests (file path not found at analyzed commit — finding may be outdated) ⚠️ (evidence computed at 4b1f800, not re-verified at the analyzed commit) quality

     No unit or end-to-end tests existed for lib/getBuildContext.ts, lib/getCurrentBranch.ts, lib/getGitHubRepoUrl.ts (repo-wide search found only lib/remarkRewriteLinks/index.test.mts). Unit evidence: zero tests exercised these files prior to this finding (grep for *.test.mts in the repo at commit 4b1f800, cncf/techdocs main). End-to-end evidence: these pure helpers run only inside docusaurus.config.ts's build step, which is not covered by any CI job asserting the resulting asset URLs (only docus:build success/failure, not output correctness). Priority 1: no unit coverage and no asserting end-to-end coverage. Added node:test suites for all three in PR (quality/test-lib-env-helpers branch) covering env-var precedence, SSH/HTTPS URL normalization, REPOSITORY_URL fallback, and prod/deploy-preview branching.

   • [missing-workflow] cncf/techdocs: npm run test:unit (lib/**/*.test.mts) never runs in CI (file path not found at analyzed commit — finding may be outdated) quality

     package.json defines test:unit (node --experimental-strip-types --test 'lib/**/.test.mts') and test (check + test:unit), but no .github/workflows/.yml invokes either. CI currently runs format-check.yml, link-check.yml, spell-check.yml only. lib/remarkRewriteLinks/index.test.mts (existing) and the 3 new suites added in PR test: cover lib/getBuildContext, getCurrentBranch, getGitHubRepoUrl #389 (getBuildContext/getCurrentBranch/getGitHubRepoUrl) can regress silently since nothing in CI ever runs them.

   • [architecture] techdocs#110+Complete gRPC.io domain ownership transfer to LF #151: GA/CSE/Netlify/DNS account-owner records and gRPC.io LF domain transfer both require owner-only credential access, not a repo doc fix (file path not found at analyzed commit — finding may be outdated) scanner

     Record account owners for websites: Google analytics & CSE, Netlify, DNS #110 asks where to record GA/CSE/Netlify/DNS account owners — there is no OWNERS-style file in techdocs for this, and populating one requires someone with admin access to those external accounts to enumerate current owners; it's not inferable from repo content. Complete gRPC.io domain ownership transfer to LF #151 (gRPC.io domain transfer to LF) is purely an external-registrar/DNS administrative action referenced via an email thread, with no corresponding file or config in this repo. Both are marked p1-high/good-first-issue but neither can be resolved by writing or editing a doc — they need a human with the actual account credentials to supply the data or perform the transfer.

   • [test-gap] techdocs#390: confirmed — package.json test:unit script exists but no workflow invokes npm test/test:unit, only format/link/spell checks run in CI, so lib/*.test.mts regressions get green checks #390 scanner

     Verified independently: package.json defines test:unit (node --test over lib/**/*.test.mts) and a combined test script, but .github/workflows/ only contains copilot-setup-steps.yml, format-check.yml, link-check.yml, spell-check.yml, and trigger-contribute-site-netlify.yml — none run npm test or npm run test:unit. lib/remarkRewriteLinks/index.test.mts (and any new suites for lib/getBuildContext.ts etc.) can regress with all CI checks green.

   🟡 MEDIUM (2)

   • [coverage-reporting] test:coverage script has no regression gate (c8 --check-coverage) package.json quality

     package.json's test:coverage script (c8 --reporter=text --reporter=lcov npm run test:unit) reports coverage but never fails the build on regression: c8's default thresholds are 0% for branches/functions/statements and 90% for lines, so a coverage drop goes unnoticed in both local runs and any future CI wiring. Added --check-coverage with thresholds matching current achieved coverage (lines 99, statements 99, branches 97, functions 100 -- actual is 99.09/99.09/97.77/100 per 'npm run test:coverage' on HEAD). Verified the gate passes at current levels (exit 0) and fails when tightened past actual coverage (exit 1, 'does not meet global threshold').

   • [architecture] techdocs#151: gRPC.io domain-to-LF transfer is a DNS/registrar ownership action, not a techdocs code change — stalled 4+ years #151 scanner

     Issue tracks completing a domain-ownership transfer of grpc.io to the Linux Foundation (registrar/DNS handoff), opened 2022-11-01, linked to grpc/grpc.io#1012. There is no file in cncf/techdocs related to grpc.io (grep across repo finds zero matches outside unrelated analyses/ directories for other projects). This is not resolvable by any code/docs change in this repo — it requires registrar access, LF IT, and the gRPC project's own org admins. Labeled p1-high and stage/stalled but has sat untouched since filing; it is a 4-year stale cross-org governance/infra tracking issue, not a techdocs work item.

   ☑️ Recently Closed — Fix Not Verified (6)

   Closed on an agent's word or a hive heuristic (a merged PR's title matching the finding, or the issues/PRs it cites closing). The hive did not re-check the condition, so it may still hold.

   • cncf/techdocs: typecheck script is broken (tsc TS5102 on removed baseUrl) and never run in check/test/CI tsconfig.json,package.json quality — closed Nov 13 (no evidence recorded), fix not verified
   • scripts/add-frontmatter.mjs main() catch block and empty-frontmatter ternary branch were uncovered (97%/90.9% stmt/branch) scripts/add-frontmatter.mjs quality — closed Nov 12 (no evidence recorded), fix not verified
   • getBuildContext/getCurrentBranch had non-deterministic branch coverage in deploy-preview and detached-HEAD paths lib/getBuildContext.ts,lib/getCurrentBranch.ts quality — closed Nov 12 (no evidence recorded), fix not verified
   • cncf/techdocs scripts/add-frontmatter.mjs skip + error-handling branches now covered scripts/add-frontmatter.mjs quality — closed Nov 12 (no evidence recorded), fix not verified
   • add-frontmatter.mjs: existing-title skip branch in processFile uncovered by PR test: regression coverage for add-frontmatter glob crash #392 fixtures scripts/add-frontmatter.mjs quality — closed Nov 12 (no evidence recorded), fix not verified
   • test placeholder - to delete test scanner — closed Nov 11 (no evidence recorded), fix not verified

   ---

   Analyzed at cncf/techdocs@3f7c75cb060c (branch main) — the latest commit when this digest was generated. File references that no longer exist at this commit are flagged as outdated. Findings marked ⚠️ were computed at an older commit and have NOT been re-verified here.

   Updated 31 times · last 2026-11-13T08:43:09Z
2. nate-double-u

   pinned this issue on Nov 12, 2026