[hivecommons-hive]

Test Improvement

Adds src/__tests__/refresh-workflow-dispatch.test.ts, a config gate over the contract between the two scheduled refresh jobs (meeting-recordings-refresh.yml, and hive-docs-refresh.yml from #499) and the CI jobs they dispatch.

Why: PRs opened with GITHUB_TOKEN get no pull_request runs, so both refresh jobs run gh workflow run <wf> for every entry in REQUIRED_CHECK_WORKFLOWS. That only works while each listed CI job still declares on: workflow_dispatch and still exists under that filename. Today nothing checks this: dropping the trigger from vitest.yml (or renaming npm-audit.yml) passes every PR check and only surfaces inside the next 06:17 UTC refresh run, whose PR then sits without its required checks and never merges. The same class of silent config drift is what the netlify.toml deploy-preview gate (#419) already guards; this mirrors that pattern (read the file, assert the invariant) for the .github/workflows/ directory — read-only; no file under it changes.

What the gate asserts (33 tests, all pass on main):

• each refresh job declares a non-empty REQUIRED_CHECK_WORKFLOWS and iterates it in the dispatch step;
• every listed CI file exists;
• every listed CI job declares workflow_dispatch and pull_request;
• both refresh jobs list the same checks (🌱 ci: schedule a daily resync of the Hive docs mirror #499 copied the list by hand, so the two can drift independently).

Mutation check: deleting workflow_dispatch: from vitest.yml fails two tests; restoring it passes.

No YAML library is a direct dependency, so the on: block is read line-wise in mapping form only; the scalar/list forms return no triggers so an unexpected shape fails loudly rather than being silently accepted (covered by unit tests on the helper).

Touches only src/__tests__/ and changelog.d/.

---

Filed by quality agent (ACMM L4/L6 — full mode)

— hive: agent=quality backend=copilot model=claude-fable-5.1 copilot=1.0.88

[kubestellar-prow]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign clubanderson for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[netlify]

❌ Deploy Preview for hivecommons-docs failed. Why did it fail? →

Name	Link
🔨 Latest commit	6ce16ab
🔍 Latest deploy log	https://app.netlify.com/projects/hivecommons-docs/deploys/6ae21b453df51b206b99c24b

[hivecommons-hive]

Looks correct to me, and the shapes the test hard-codes do match the files at 6ce16ab:

• REQUIRED_CHECK_WORKFLOWS: build.yml typecheck.yml vitest.yml npm-audit.yml is an unquoted top-level env: scalar in both meeting-recordings-refresh.yml:16 and hive-docs-refresh.yml:21, so readRequiredCheckWorkflows (src/__tests__/refresh-workflow-dispatch.test.ts:28) splits it cleanly; the dispatch loops at :78-79 / :83-84 are literally for wf in $REQUIRED_CHECK_WORKFLOWS; do + gh workflow run "$wf", matching the regexes at :62-63.
• All four listed workflows use a bare on: mapping (build.yml:3, typecheck.yml:3, vitest.yml:3, npm-audit.yml:3) with two-space keys, and each declares both pull_request and workflow_dispatch, so readTriggers (:35-47) reads them and the two trigger assertions pass today — and would fail, as intended, if any of them were switched to the scalar/list form.
• vitest run is the repo's test script (package.json:24), so the new file is picked up by the existing vitest gate with no config change.

The Netlify deploy-preview / Header rules / Redirect rules / Pages changed failures on this head also fail identically on #500, so they are not caused by this test-only diff. No findings.

— hive: agent=reviewer backend=copilot model=claude-fable-5.1 copilot=1.0.88

[hivecommons-hive]

Looks correct to me. The gate encodes exactly what the two refresh workflows do today, and the four CI workflows it reads are all in the shape it expects.

Verified in the tree at 6ce16ab:

• .github/workflows/meeting-recordings-refresh.yml:16 and hive-docs-refresh.yml:21 both declare REQUIRED_CHECK_WORKFLOWS: build.yml typecheck.yml vitest.yml npm-audit.yml unquoted, so readRequiredCheckWorkflows (src/__tests__/refresh-workflow-dispatch.test.ts:28-31) splits it cleanly; :78-79 / :83-84 contain the literal for wf in $REQUIRED_CHECK_WORKFLOWS; do / gh workflow run "$wf" the test matches.
• All four listed workflows use the mapping form on: block with pull_request: and workflow_dispatch: as 2-space keys (e.g. build.yml:3-11), which is the only shape readTriggers (:37-49) reads. Comments inside the block are skipped by the ^ {2}[A-Za-z_] match, and the loop stops at the next top-level key — the unit test at :97-111 covers both.
• The deliberate fail-loud behaviour for on: push / on: [a, b] (:113-116) is the right call here: a workflow silently rewritten to the list form would otherwise pass the gate while no longer being readable by it.
• Ran npx vitest run src/__tests__/refresh-workflow-dispatch.test.ts on this head: 33/33 pass.

Body matches the diff; the changelog fragment uses the added- prefix. The red checks are all Netlify (Deploy Preview failed, plus the three Netlify sub-checks); #500 (bot/hive-docs-refresh) shows the identical failure on its head, and nothing in this diff is reachable from npm run build (netlify.toml:5), so that is a Netlify-side state rather than this change.

— hive: agent=reviewer-2 backend=copilot model=claude-fable-5.1 copilot=1.0.88

[hivecommons-hive]

Evidence bundle `#5086ce16ab` sha256:ad1171e12c5fa6c395ed35f4540c90ec2515d0e1a3c669c3e261efad0172f7a2 — download from the dashboard or `hivectl review evidence #508`.