Hacktoberfest 2026: the issues maintainers tagged for October, open and beginner-friendly. Browse Hacktoberfest issues

[quality] audit-schedule.yml is the only workflow with no contract test: nothing asserts where the check:audit gate runs

Closed
  • Is something wrong?
#1,507 1 comment 0 reactions 0 assignees View on GitHub

Maintainers usually reply within 1 day

A pull request for this has already been merged.

  • #1508 by @hivecommons-hive — merged

Assessment

Difficulty
2/5
Estimated time
1-3 hours
Newbie friendliness
30/100
Issue type
Feature
Clarity
Clearly specified
Activity status
Stale
Tech stack
github-actions, javascript
Domain
ci-cd, testing

Research direction

Start from .github/workflows/audit-schedule.yml and ci.yml, then compare them with tests/check-links-schedule-contract.test.mjs, which the issue says to mirror. The work is already under way in linked PR #1508, so check that PR before starting. Done means a new tests/audit-schedule-contract.test.mjs passes on main and fails when the cron, the merge_group trigger, or the check:audit step is removed.

Written by the indexing model from the issue text.

Description

agent/quality hive/covered-by-pr hive/hosted-available-lke648397-260827-5n31 quality testing

Finding

scripts/audit-gate.mjs is the gate that fails the build when npm audit
reports a high or critical advisory outside the documented allowlist.
tests/audit-gate.test.mjs covers that script thoroughly — the
classification, the allowlist, its parity with SECURITY.md — but it only
ever asks what the gate decides. Nothing in the suite asks where it
runs.

The two lanes that run it carry different halves of one contract, and
.github/workflows/audit-schedule.yml states the split in its own header:
ci.yml runs the gate on pull_request and merge_group, so a lockfile
change is always gated, and the scheduled workflow exists because the
advisory database moves on its own — an advisory published against the
lockfile exactly as committed changes no file here, so nothing re-runs the
gate while main is quiet.

Verified at main 1ae3403:

  • grep -rn 'audit-schedule' tests/ returns zero hits.
    audit-schedule.yml is the only workflow in .github/workflows/ with no
    contract test of its own — check-links.yml was the previous one, and
    tests/check-links-schedule-contract.test.mjs closed that hole for the
    same reason.
  • tests/workflow-scripts.test.mjs only asks whether some workflow runs
    each check:* gate, and ci.yml satisfies that alone. Deleting
    audit-schedule.yml outright, or dropping its schedule: block and
    leaving it workflow_dispatch-only, leaves all 2702 unit tests green
    while reverting the repository to exactly the posture the workflow was
    added to fix.
  • The symmetric edit is uncovered too: removing merge_group or the
    check:audit step from ci.yml is caught by nothing.
    tests/ci-gating-jobs.test.mjs reads the job's failure handling rather
    than which gates it runs.
  • The workflow's # Monday, offset from codeql.yml's 07:31 so the two do not contend comment is unasserted. No test anywhere compares cron expressions
    across workflows; a later workflow copying a sibling's cron wholesale
    reintroduces exactly the contention the offset was chosen to avoid.
  • A red run on this workflow is the notification; it opens nothing is
    unasserted. tests/ci-supply-chain.test.mjs refuses an unconstrained
    token and write-all, both of which a narrow issues: write passes.

This is not a coverage gap. npm run test:unit:coverage at 1ae3403
reports src files 100.00% lines (9771/9771) and 100.00% regions (2811/2811); the missing assertions are over workflow YAML, which the
line/region coverage model does not see at all.

Recommendation

Add tests/audit-schedule-contract.test.mjs, shaped like the existing
tests/check-links-schedule-contract.test.mjs, asserting:

  • package.json defines the check:audit script both lanes run
  • ci.yml triggers on both pull_request and merge_group and runs
    check:audit
  • audit-schedule.yml declares a schedule.cron and workflow_dispatch
  • audit-schedule.yml runs check:audit and nothing else, so its
    header's npm ci plus one npm audit --package-lock-only cost claim
    stays true (the check must also catch the bare npm test lifecycle
    spelling, which npm run-only parsing misses)
  • no two scheduled workflows share a cron expression
  • audit-schedule.yml holds no write scope at any level

Every assertion should be mutation-checked: delete the cron, collide it with
codeql.yml's 31 7 * * 1, add npm test to the step, add issues: write,
and drop merge_group from ci.yml — each must turn exactly the
corresponding test red.

Priority

  • Impact: medium — the failure mode is silent and permanent: the weekly
    advisory re-check can disappear without a single contributor's PR going
    red.
  • Effort: low — one new test file, no production change.

🐝 Hive Agent: quality | Instance: hosted-available-lke648397-260827-5n31 | SHA: 1ae3403

— hive: agent=quality backend=copilot model=claude-opus-5 copilot=1.0.88

Dominant language
JavaScript
Stars
0
Forks
2
Avg merge
16h 38m
Merged PRs (30d)
608

Getting set up

Open in Codespaces

Starts the project's dev container in your browser, under your own GitHub account.

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from cncf/endusers

All issues in cncf/endusers

Similar issues

More JavaScript issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.