Hacktoberfest 2026: the issues maintainers tagged for October, open and beginner-friendly. Browse Hacktoberfest issues

[quality] checkOrgMember's missing payload.repository guard (auth.ts:43-45) is reached by no bundle test

Closed
  • Is something wrong?
#446 1 comment 0 reactions 0 assignees View on GitHub

Maintainers usually reply within 2 days

@hivecommons-hive is already working on this.

Since Oct 10, 2026.

  • #447 by @hivecommons-hive — open

Assessment

Difficulty
2/5
Estimated time
1-3 hours
Newbie friendliness
35/100
Issue type
Feature
Clarity
Clearly specified
Activity status
Stale
Tech stack
github-actions, typescript
Domain
testing

Research direction

Start with src/utils/auth.ts:43-45 and the existing __tests__/utils/auth.test.ts; use the payload-guard patterns in pluginPayloadGuards.test.ts to create an issue_comment bundle test with repository removed. Assert the debug log, no organization-membership GET, successful collaborator assignment, and no authorized users found for a stranger. Done means the new bundle test passes and covers the missing guard.

Written by the indexing model from the issue text.

Description

agent/quality hive/covered-by-pr hive/hosted-available-lke648397-260827-5q9t needs-kind quality testing

Finding

checkOrgMember (src/utils/auth.ts:43-45) answers not a member without an API call when the event payload carries no repository object, logging checkOrgMember error: context payload repository undefined. Every bundle fixture carries repository, so the arm is exercised only by the unit suite.

Evidence (main @ d0b1d87, Node v26.10.0, vitest 5.0.3):

  • Unit: npx vitest run --coverage → 100 % lines; the arm is green via __tests__/utils/auth.test.ts.
  • End-to-end: npm run test:coverage:e2e on a scratch branch = origin/main + the heads of the 10 open hold-gated bundle PRs (#423 #425 #427 #429 #431 #433 #435 #437 #439 #445; 70 files / 449 tests pass) → 98.65 % lines of src/. auth.ts:44-45 have 0 hits.
  • The two reports come from different transforms (vite vs. tsc+webpack) and are not combined, per vitest.e2e-coverage.config.mjs; they are read separately above.

Of the rest of that e2e residual, the ten command-side could not check … auth wrappers and auth.ts:181/210/217/224 are unreachable (#386); the reset*() helpers in config.ts:220, labeling.ts:92, mergeQueue.ts:67, owners.ts:302-303, pullRequestOwners.ts:55-56, tide.ts:236-237 are test-only hooks; events.ts:48 / handlePullReq.ts:46 need an empty handler registry, approve.ts:236 is an exhaustive-switch default, command.ts:38 is guarded by every caller's hasCommand, meow.ts:112 needs body.cancel() to reject on a fresh body, and tide.ts:96 is the retryIf default both callers override. auth.ts:43-45 is the one arm a crafted payload reaches: context.repo falls back to GITHUB_REPOSITORY, so the collaborator and comment probes still run and the command completes.

Recommendation

  • add a bundle test that runs /assign @user on an issue_comment payload with repository deleted (as pluginPayloadGuards.test.ts does for other objects), asserting the debug line, no GET /orgs/… read, and that a collaborator is still assigned while a stranger fails with no authorized users found

Priority

  • Impact: low
  • Effort: low

Filed by quality agent (hold-gated mode)

🐝 Hive Agent: quality | Instance: hosted-available-lke648397-260827-5q9t | SHA: 183f5b6

— hive: agent=quality backend=copilot model=claude-fable-5.1 copilot=1.0.88

Dominant language
TypeScript
Stars
132
Forks
23
Avg merge
1d 19h
Merged PRs (30d)
166

Getting set up

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from cncf/prow-github-actions

All issues in cncf/prow-github-actions

Similar issues

More TypeScript issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.