Skip to content

[quality] 🧪 test: pin self-authored auto-merge sweep merge-safety guards - #4808

Merged
clubanderson merged 1 commit into
v4from
quality/test-automerge-sweep-guards
Aug 26, 2026
Merged

[quality] 🧪 test: pin self-authored auto-merge sweep merge-safety guards#4808
clubanderson merged 1 commit into
v4from
quality/test-automerge-sweep-guards

Conversation

@kubestellar-hive

Copy link
Copy Markdown
Contributor

Test Improvement

Adds src/pkg/github/automerge_sweep_guards_test.go covering the untested merge-safety branches of the self-authored auto-merge sweep — the path where the Hive App squash-merges its own PRs with no human review:

  • trySweepSelfAuthoredPR 71.4% → 98.0%: table-driven guard tests for gone/fetch-pr, closed, draft, authorship-changed-at-eval, missing-head-sha, not-mergeable, commitGreen API error, status-pending, recheck gone/error, head-changed-since-eval (both vanished and pushed SHA), merge-failed, merge-not-applied, plus the green happy path.
  • refreshRateLimitCache 33.3% → 100%: success path (GET /rate_limit hit exactly once) and swallowed API error — this is the fix for the observed live stall where go-github's stale cached verdict refused requests for six minutes.
  • isHiveAppReviewAuthor 66.7% → 100%: nil client, nil review, blank appBotLogin, forged author, trusted App author.
  • requiredStatusCheckContexts 76.2% → 95.2%: blank branch, ErrBranchNotProtected as a known empty set, API error fails closed, contexts+checks parsing with nil check entries.

pkg/github: 91.9% → 92.5%. Full go test ./pkg/github/ passes; gofmt/vet clean. Test-only change — no production code touched.

Related Issue

Fixes #4807

Bead: da00972f-57b


Filed by quality agent (hold-gated mode). Human review required.

— hive: agent=quality backend=copilot model=claude-fable-5

Cover the untested guard branches of the self-authored sweep path:
- trySweepSelfAuthoredPR (71.4% -> 98.0%): gone/fetch-pr, closed, draft,
  not-app-authored at eval, missing-head-sha, not-mergeable, commitGreen
  error, status-pending, recheck gone/error, head-changed-since-eval
  (vanished and pushed), merge-failed, merge-not-applied, plus the green
  merge happy path.
- refreshRateLimitCache (33.3% -> 100%): success writes back to the
  go-github cache via GET /rate_limit; API errors are swallowed.
- isHiveAppReviewAuthor (66.7% -> 100%): nil client, nil review, blank
  appBotLogin, forged author, and trusted App author.
- requiredStatusCheckContexts (76.2% -> 95.2%): blank branch,
  ErrBranchNotProtected as known-empty-set, API error fails closed,
  contexts+checks parsing with nil check entries.

pkg/github coverage: 91.9% -> 92.5%.

Refs #4807

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Signed-off-by: sec-check <sec-check@hive.kubestellar.io>
@kubestellar-prow kubestellar-prow Bot added dco-signoff: yes Indicates the PR's author has signed the DCO. size/L Denotes a PR that changes 100-499 lines, ignoring generated files. labels Aug 26, 2026
@github-actions

Copy link
Copy Markdown
Contributor

Changelog: this PR changes code but does not touch CHANGELOG.md.

If it is user-visible — a feature, a fix an operator would notice, a
security change, a migration, a deprecation, or anything breaking —
please add a line under ## Unreleased. If it is a refactor, a
test-only change, or dependency churn, no entry is needed and you can
ignore this.

This is a reminder, not a gate; it never blocks a merge.

@clubanderson

Copy link
Copy Markdown
Member

Review record: tests drive the REAL trySweepSelfAuthoredPR / refreshRateLimitCache / isHiveAppReviewAuthor / requiredStatusCheckContexts through a one-PR httptest GitHub API — no drifted copies. Hermetic (httptest only; no live endpoints, env, or /data). Mutation-checked two merge-safety guards: disabling the draft skip → draft_PR_is_never_merged red; neutering the head-recheck comparison → both head_SHA_vanished_at_recheck and push_landed_between_eval_and_merge red; restored green. Full pkg/github suite green on the union with current v4 head, coverage 91.5% ≥ floor 90. No test-name collisions with the recent watcher-test merges. DCO present.

/lgtm
/approve

@clubanderson
clubanderson merged commit 6d60c21 into v4 Aug 26, 2026
39 of 40 checks passed
@kubestellar-prow kubestellar-prow Bot added the lgtm Indicates that a PR is ready to be merged. label Aug 26, 2026
@kubestellar-prow

Copy link
Copy Markdown
Contributor

LGTM label has been added.

DetailsGit tree hash: f9a64352ee1397c4a5891e9cfff1418af6aaa454

@kubestellar-prow

Copy link
Copy Markdown
Contributor

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: clubanderson

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@kubestellar-prow
kubestellar-prow Bot deleted the quality/test-automerge-sweep-guards branch August 26, 2026 16:35
@kubestellar-prow kubestellar-prow Bot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Aug 26, 2026
@github-actions

Copy link
Copy Markdown
Contributor

Thank you for your contribution! Your PR has been merged.

Check out what's new:

Stay connected: Slack #kubestellar-dev | Multi-Cluster Survey

clubanderson pushed a commit that referenced this pull request Aug 26, 2026
#4808)

Cover the untested guard branches of the self-authored sweep path:
- trySweepSelfAuthoredPR (71.4% -> 98.0%): gone/fetch-pr, closed, draft,
  not-app-authored at eval, missing-head-sha, not-mergeable, commitGreen
  error, status-pending, recheck gone/error, head-changed-since-eval
  (vanished and pushed), merge-failed, merge-not-applied, plus the green
  merge happy path.
- refreshRateLimitCache (33.3% -> 100%): success writes back to the
  go-github cache via GET /rate_limit; API errors are swallowed.
- isHiveAppReviewAuthor (66.7% -> 100%): nil client, nil review, blank
  appBotLogin, forged author, and trusted App author.
- requiredStatusCheckContexts (76.2% -> 95.2%): blank branch,
  ErrBranchNotProtected as known-empty-set, API error fails closed,
  contexts+checks parsing with nil check entries.

pkg/github coverage: 91.9% -> 92.5%.

Refs #4807

Signed-off-by: sec-check <sec-check@hive.kubestellar.io>
Co-authored-by: sec-check <sec-check@hive.kubestellar.io>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
clubanderson pushed a commit that referenced this pull request Aug 26, 2026
#4808)

Cover the untested guard branches of the self-authored sweep path:
- trySweepSelfAuthoredPR (71.4% -> 98.0%): gone/fetch-pr, closed, draft,
  not-app-authored at eval, missing-head-sha, not-mergeable, commitGreen
  error, status-pending, recheck gone/error, head-changed-since-eval
  (vanished and pushed), merge-failed, merge-not-applied, plus the green
  merge happy path.
- refreshRateLimitCache (33.3% -> 100%): success writes back to the
  go-github cache via GET /rate_limit; API errors are swallowed.
- isHiveAppReviewAuthor (66.7% -> 100%): nil client, nil review, blank
  appBotLogin, forged author, and trusted App author.
- requiredStatusCheckContexts (76.2% -> 95.2%): blank branch,
  ErrBranchNotProtected as known-empty-set, API error fails closed,
  contexts+checks parsing with nil check entries.

pkg/github coverage: 91.9% -> 92.5%.

Refs #4807

Signed-off-by: sec-check <sec-check@hive.kubestellar.io>
Co-authored-by: sec-check <sec-check@hive.kubestellar.io>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Signed-off-by: kubestellar-hive[bot] <280983584+kubestellar-hive[bot]@users.noreply.github.com>
clubanderson pushed a commit that referenced this pull request Aug 26, 2026
#4808)

Cover the untested guard branches of the self-authored sweep path:
- trySweepSelfAuthoredPR (71.4% -> 98.0%): gone/fetch-pr, closed, draft,
  not-app-authored at eval, missing-head-sha, not-mergeable, commitGreen
  error, status-pending, recheck gone/error, head-changed-since-eval
  (vanished and pushed), merge-failed, merge-not-applied, plus the green
  merge happy path.
- refreshRateLimitCache (33.3% -> 100%): success writes back to the
  go-github cache via GET /rate_limit; API errors are swallowed.
- isHiveAppReviewAuthor (66.7% -> 100%): nil client, nil review, blank
  appBotLogin, forged author, and trusted App author.
- requiredStatusCheckContexts (76.2% -> 95.2%): blank branch,
  ErrBranchNotProtected as known-empty-set, API error fails closed,
  contexts+checks parsing with nil check entries.

pkg/github coverage: 91.9% -> 92.5%.

Refs #4807

Signed-off-by: sec-check <sec-check@hive.kubestellar.io>
Co-authored-by: sec-check <sec-check@hive.kubestellar.io>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Signed-off-by: Andy Anderson <andy@clubanderson.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

approved Indicates a PR has been approved by an approver from all required OWNERS files. copilot dco-signoff: yes Indicates the PR's author has signed the DCO. hold lgtm Indicates that a PR is ready to be merged. size/L Denotes a PR that changes 100-499 lines, ignoring generated files.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[quality] Self-authored auto-merge sweep: merge-safety guard branches untested

1 participant