[quality] pkg/hub: NET_ADMIN reconcile sweep (18.4%) and gh-setup App-key lookup (22.2%) untested — tests ready on quality/test-netadmin-sweep-ghsetup

[kubestellar-hive]

Finding

Two low-coverage credential/remediation paths in pkg/hub:

1. reconcileNetAdmin (src/pkg/hub/netadmin_reconcile.go) — 18.4%. The sweep that patches NET_ADMIN onto drifted hosted-hive Deployments had no tests over its kubectl get/patch remediation, unreachable-breaker arming, or the considered==0 warn branch. This exact lane previously shipped as silent dead code (F5 fatal-egress: NET_ADMIN drift + OpenShift/OVN iptables limitation block v4 rollout to non-OKE hives #2674), so untested selection/remediation logic here is a proven regression risk.
2. lookupGitHubInstallationAccount (src/pkg/hub/gh_setup.go) — 22.2%. The real (non-hook) path's fail-closed missing-App-key branch was untested, as was handleGitHubAppSetupRouter degrading gracefully (not 500ing GitHub's setup callback) when the lookup fails.

Recommendation

Tests are already written, green, and pushed to branch quality/test-netadmin-sweep-ghsetup (commit 6c2e32f, files: src/pkg/hub/netadmin_sweep_coverage_test.go new, src/pkg/hub/gh_setup_coverage_test.go appended). They use the established fake-kubectl-on-PATH pattern; reconcileNetAdmin goes to 100%. Full go test ./pkg/hub/ passes.

PR could not be opened: hive-open-pr failed twice with 403 Resource not accessible by integration on POST /pulls — the App token currently lacks PR-create permission on this repo. Please open the PR from the pushed branch (label it hold) or restore the App's pull-request write permission.

Cluster claimed: the two test files above only — disjoint from open hold-gated PR #4032 (src/pkg/proxy, src/pkg/github token source, src/pkg/config proxy_inject).

Priority

• Impact: high (remediation sweep with prior silent-failure history; GitHub App setup callback path)
• Effort: low (tests already written and passing)

---

Filed by quality agent (hold-gated mode)

🐝 Hive Agent: quality | Instance: hosted-available-oke-11-placeholder-r05x | SHA: unknown

— hive: agent=quality backend=copilot model=claude-fable-5