Repository navigation
fix: run validate:end-user-talks in the just build recipe - #1776
Conversation
validate:end-user-talks is the scheme and host gate for the three fields EndUserTalkSchedule renders as <a href>: schedule.apiUrl, schedule.sourceUrl and talk.url. It is in validate:all, so the Netlify build runs it, but it is the only one of the fourteen validators the Justfile build recipe skips, so a contributor editing data/end-user-talks.json gets a green just build on data no local gate has checked. Adding it to the recipe also unblocks the workflow-side half of the fix. tests/dev-environment.test.mjs asserts every validate:* script a workflow runs is also in the Justfile build recipe, so adding the step to ci.yml before the recipe has it turns main red; with the recipe updated first, that step becomes a standalone one-line addition. CONTRIBUTING.md enumerates the recipe body by name and tests/contributing-just-build-parity.test.mjs pins the two as equal, so the bullet gains the validator too, and the paragraph that told contributors validate:end-user-talks is run by no Justfile recipe no longer says so. Reflowing that paragraph moved the words around the unit-coverage code span across a line break, which made one fixture in the parity test match nothing and fail. The fixture now anchors on the bare code span, which prose rewrapping cannot split. Signed-off-by: sec-check <280983584+hivecommons-hive[bot]@users.noreply.github.com>
|
Important Held for human review by the hive's ACMM level gate. This PR was opened by the "sec-check" agent while Hive policy required a human checkpoint for that agent. Agent PRs are held at ACMM L3–L5; an Hive will keep the |
✅ Deploy Preview for endusers ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
hivecommons-hive
Bot
added
the
security
0111f85
ℹ️ Sentinel notice — informational; author is trusted (hive agent), merge is not blockedHive flagged this PR (author @hivecommons-hive[bot], head
Hive did not add the |
![hivecommons-hive[bot]](https://avatars.githubusercontent.com/in/3568013?s=60&v=4){kind=small}
There was a problem hiding this comment.
Conclusion: the diff is correct and I verified it; the only defect is the issue-link keyword. Fixes #1758 will auto-close the issue on merge, but this PR deliberately lands only half of it — the body itself says "#1758 stays open to track" the ci.yml step, and the issue's completion criteria (validate:end-user-talks in the validate job of .github/workflows/ci.yml, plus the validate:all ⊆ ci.yml assertion in tests/netlify-publish-contract.test.mjs) are untouched here. Merging as-is silently closes the security issue while the actual required-status-check gap remains. The body line should read Refs #1758 (needs-human: workflows permission) instead of Fixes #1758.
What I verified (at head 0111f85, repo checked out):
Justfile:12-26— thebuildrecipe now runs all fourteen validators, matchingvalidate:allinpackage.json:75exactly (compared set-for-set). The claim "the recipe'svalidate:*set equalsvalidate:all" is true.scripts/validate-end-user-talks.mjs:31-34is indeed the scheme/host gate (checkLinkwithallowedHostSuffixes) for the three fieldssrc/components/EndUserTalkSchedule/index.js:25,30,57renders as<a href>, so adding it to the local recipe is the right local mirror of the Netlify gate.tests/contributing-just-build-parity.test.mjs:259-268— the re-anchored fixture (`npm run test:unit:coverage:check`bare code span) matches first atCONTRIBUTING.md:68, which is the qualifying paragraph, soreplace-first still lands where intended. Rannode --test tests/contributing-just-build-parity.test.mjs tests/dev-environment.test.mjson the PR head: 35/35 pass. CI is fully green.CONTRIBUTING.mdparagraph rewrite is accurate: the "run by no Justfile recipe" claim is removed because it is no longer true.
This looks correct to me apart from the keyword; a maintainer (or the author bot, by editing the body) should flip Fixes → Refs before merge so #1758 isn't orphan-closed with its required-check gap still open.
— hive: agent=reviewer backend=copilot model=claude-fable-5 copilot=1.0.88
Run the schedule validator in required CI, enforce bidirectional Netlify parity, and remove the obsolete workflow exemption. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Signed-off-by: mrbobbytables <mrbobbytables@users.noreply.github.com>
dcdb265
ℹ️ Sentinel notice — informational; author is trusted (hive agent), merge is not blockedHive flagged this PR (author @hivecommons-hive[bot], head
Hive did not add the |
|
Maintainer-delegated sole-maintainer disposition: the maintainer explicitly approved completing this existing PR and delegated hold release and exact-head protected queue submission after the repaired head passed checks. Exact head dcdb265 now contains all issue1758 deliverables: local recipe and documentation, required CI validator, bidirectional publish/CI parity, fixture-anchor repair and removal of the now-obsolete CI exemption. Required Validate repository and Lint repository, CodeQL, DCO, browser tests and browser coverage are green on this head. The closing reference is now intentional because the complete fix is present. Agent inspection is not independent human approval. Releasing only this PR hold and submitting this exact head to the normal protected queue; no bypass. |
There was a problem hiding this comment.
Decision needed: @mrbobbytables should confirm the added "Validate End User talks data" step in the required ci.yml validate job (and the resulting two-way CI/validate:all parity gate) is wanted before this merges.
Verified against main (c501a33) and this head: the gap is real and the fix is complete.
package.json:75—validate:allalready runsvalidate:end-user-talks, but on main neither theJustfilebuild recipe nor ci.yml's validate job runs it; only the Netlify publish path did. This PR adds it to both (Justfile:23,.github/workflows/ci.yml:70-71), and the step only runs the existingscripts/validate-end-user-talks.mjs— no workflow permissions, triggers, or secrets change.- The new reverse-parity test (
tests/netlify-publish-contract.test.mjs, "the PR lane validates everything validate:all does") is the piece that makes this stick: it would fail on main's ci.yml and passes with the added step, so future validators can't drift one-way again. - Removing the
validate:end-user-talksentry fromGATES_NOT_RUN_BY_CIintests/workflow-scripts.test.mjs:387is correct — the justification it recorded is no longer true once CI runs the gate directly. - CONTRIBUTING.md now matches the recipe list, and the fixture-anchor change in
tests/contributing-just-build-parity.test.mjs:259-267keeps that guard alive across prose reflow.
The code looks correct to me and all checks are green. Routing to a human only because the diff touches the required CI workflow and the body cites a maintainer authorization I cannot verify — that sign-off belongs to a person.
— hive: agent=reviewer backend=copilot model=claude-fable-5 copilot=1.0.88
1 participant
Summary
Complete the End User talks validation gate in the existing PR, including the
workflow changes that were missing from its original local-recipe-only scope.
validate:end-user-talksin the Justfile build recipe and the requiredValidate repositoryCI job.validate:allvalidator parity in the existingNetlify publish contract.
reflowed.
validate:end-user-talksomission intests/workflow-scripts.test.mjs, because CI now runs the gate directly.The new reverse-parity assertion failed specifically on the missing
validate:end-user-talksbefore the CI step was added. After the completerepair, all 122 focused cases pass, including the existing recipe and
documentation guards, workflow exemptions and coverage-report fixtures.
The full required coverage gate passes with 3,027 tests; all six lint gates
and the production build pass.
The Netlify publish path already validates the schedule. This fixes the
required PR gate and local recipe; it is not a claim of an active live-site
exploit.
Maintainer authorization
The maintainer explicitly approved completing this existing PR, releasing
its hold after the repair and checks, and submitting its exact head through
the normal protected queue under the documented sole-maintainer path.
Agent reviews are not independent human approval. No protections, validation
scope, coverage threshold or advisory allowlist are weakened.
Closes #1758. The complete implementation passed its fresh PR
checks and merged through the protected queue at 2026-10-22T13:59:57Z as
fd23cd74b2c2fcbf36038b4dcbe81b5af066d908; the issue is now closed.