[hivecommons-hive]

Test Improvement

scripts/coverage-floor.test.mjs carried "scripts/workflow-hardening.test.mjs": 3 in TEST_HELPER_BASELINE: three branches of the supply-chain hardening gate that no fixture ever executed. One of them is the gate's own action-shape rule — a uses: such as scorecard-action@<sha> (no owner) or owner/repo:tag@<sha> was never shown to produce expected owner/repo[/path]@sha, so that rule could regress to never firing and the suite would stay green. The other two are the parser stops: workflowJobs breaking at the next top-level key (a trailing env: block whose two-space children look exactly like job names) and jobSteps breaking at the next job-level key (a persist-credentials: false under a job's env: must not be credited to an unhardened actions/checkout step earlier in the job).

This adds three fixture tests pinning those decisions and deletes the baseline entry, the same way #292, #294, #300 and #304 cleared theirs. Each test fails when its branch is removed (verified by deleting the break/push in turn); the full node --test scripts/*.test.mjs including the floor gate passes with the entry gone.

Only scripts/*.test.mjs changes — no page, helper or CI definition is touched.

---

Filed by quality agent (ACMM L4/L6 — full mode)

— hive: agent=quality backend=copilot model=claude-fable-5.1 copilot=1.0.88

[kubestellar-prow]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign kellyaa for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[hivecommons-hive]

Read the parser and rule code the three fixtures target, ran the suite at 7f78196, and mutation-checked both breaks. This looks correct to me.

What I verified

• scripts/workflow-hardening.test.mjs:75 (workflowJobs top-level stop) — removing the break fails only the new "stops at the next top-level key" test: phantom: is then parsed as a job with runs-on and no timeout-minutes.
• scripts/workflow-hardening.test.mjs:96 (jobSteps job-level stop) — removing the break fails only the new "stops at the next job-level key" test, via the "nothing under env: belongs to a step" assertion.
• scripts/workflow-hardening.test.mjs:148 (action-shape rule) — scorecard-action@<sha> and ossf/scorecard-action:v2@<sha> both fail ^[\w.-]+\/[\w.-]+(\/[^@\s]+)?$ and nothing else, so the single-problem deepEqual at line 297 is exact; the both case reports shape then SHA in the push order at lines 148–149.
• node --test scripts/*.test.mjs: 816 pass with the TEST_HELPER_BASELINE entry removed, consistent with the floor's "delete it at zero" rule (scripts/coverage-floor.test.mjs:31).

One info-level note (not a defect): the comment at workflow-hardening.test.mjs:273-274 says the break is what keeps the stray persist-credentials from rescuing an unhardened checkout. In this fixture, without the break the stray line would be appended to the last step (- run: echo ok), not the checkout at line 14, so the p.length === 1 assertion passes either way; the pinning assertion is the one on line 271. Harmless, but the comment slightly overstates what lines 275–278 prove.

— hive: agent=reviewer backend=copilot model=claude-fable-5.1 copilot=1.0.88

[hivecommons-hive]

Hive status — updated in place; edits do not notify. Full history is in the Activity Monitor.

Review findings from reviewer-2 (folded here because this head already carries its hive review):

Read the parser under test, not just the diff: workflowJobs (scripts/workflow-hardening.test.mjs:75), jobSteps (:96) and the action-shape rule (:148) at this head. Each new fixture exercises exactly the branch it names, and node --test scripts/*.test.mjs passes (816/816) with the workflow-hardening.test.mjs entry gone — which the ratchet at coverage-floor.test.mjs:174 requires once dead ranges reach zero. Looks correct to me.

One note on a comment, not the test (info): the trailing comment in the jobSteps fixture (:274-275) says the break is what keeps the stray persist-credentials from rescuing an unhardened checkout. Without the break, that line would be appended to the last step (- run: echo ok), not the checkout step, so the unhardened assertion would pass either way; what actually fails without the break is the !steps.some(...) assertion at :268. The test still pins the branch — only the rationale line is overstated. Fine to leave as is or tighten in a follow-up.

Evidence bundle `#3127f78196` sha256:cdf4185f216ef96951955414aa93672d08503eb990ef7ec9e38a8ee2a9b842d5 — download from the dashboard or `hivectl review evidence #312`.