[governor] 🐝 Hive Advisory Report #388

Activity

1. hivecommons-hive commented on Nov 10, 2026

   

   hivecommons-hiveBot

   on Nov 10, 2026 – with hivecommons-hive

   Last edited by hivecommons-hive

   Author

   More actions

   🐝 Advisory Digest — 2026-11-12 02:39 EST

   Automated code review findings from Hive agents. Each finding includes a file reference and suggested fix. This comment is updated periodically.

   Advice

   Frozen for governor mode SURGE until 2026-11-17 (next review in 6 day(s)). The list of recommendations is frozen; their numbers, items and links are recomputed on every digest.

   Counts quoted: governor actionable queue 2 PRs / 34 issues (what mode and cadence key on; excludes held, draft, in-review and human-gated items) — Overview chart 6 open PRs / 34 open issues (every open or held item across repo cards; the queue-health advice counts these).

   • Reduce the blocked PR queue — No longer applies: the signal that triggered this advice has cleared since the epoch began.
   • Throttle PR-producing lanes — The hive is in surge; reduce new PR creation until the queue falls back to a steadier mode. (signals: mode=SURGE, governor_issues=34, governor_prs=2)
   • Document conventions in AGENTS.md — When pressure is high, clear local conventions reduce review churn and repeated agent mistakes. (signals: mode=SURGE)

   Findings: 10

   💡 Showing top 10 findings (by severity). 27 more exist. Set governor.advisory.show_all: true to see all.

   Severity	Count
   🟠 high	6
   🟡 medium	4

   🟠 HIGH (6)

   • [onboarding] techdocs repo lacks local build/preview instructions (npm install, docus:start) README.md guide

     The cncf/techdocs repo (a Docusaurus site with npm scripts like docus:start, docus:build, check, test) has no documented procedure for a new contributor to install dependencies and preview the site locally. README.md and docs/index.md describe the site's content but never mention 'npm install' or any docus:* script. docs/repo-setup.md is guidance aimed at other CNCF projects' repos, not instructions for building this repo. CI workflows (.github/workflows/.yml) run npm scripts via a custom action but these are not surfaced to human contributors. Verified via grep: zero occurrences of 'npm install' or 'npm start' in README.md or docs/.md.

   • [coverage-gap] lib/remarkRewriteLinks/index.ts: 4 branches uncovered by unit tests (89.74% branch coverage) lib/remarkRewriteLinks/index.ts quality

     rewriteHref() in lib/remarkRewriteLinks/index.ts had 4 uncovered branches (c8 --reporter=text on node --experimental-strip-types --test 'lib/**/*.test.mts', local run against HEAD, 2026-11-11): (1) line 87, empty-path-after-split short-circuit (href consisting only of a query/fragment, e.g. '?x'); (2) line 99, the cross-plugin capture group 2 being undefined (a bare '../docs' with no sub-path); (3) line 112, the .mdx branch of the site-absolute strip-extension ternary; (4) line 140, file.path being undefined in the remark plugin wrapper. Repo has no end-to-end/integration suite (CI only runs format-check.yml, link-check.yml, spell-check.yml per [quality] npm run test:unit never runs in CI — unit tests have no CI signal #390), so these branches were covered by neither unit nor end-to-end tests -> Priority 1.

   • [coverage-gap] cncf/techdocs lib/ build-context helpers (getBuildContext, getCurrentBranch, getGitHubRepoUrl) had no unit tests (file path not found at analyzed commit — finding may be outdated) quality

     No unit or end-to-end tests existed for lib/getBuildContext.ts, lib/getCurrentBranch.ts, lib/getGitHubRepoUrl.ts (repo-wide search found only lib/remarkRewriteLinks/index.test.mts). Unit evidence: zero tests exercised these files prior to this finding (grep for *.test.mts in the repo at commit 4b1f800, cncf/techdocs main). End-to-end evidence: these pure helpers run only inside docusaurus.config.ts's build step, which is not covered by any CI job asserting the resulting asset URLs (only docus:build success/failure, not output correctness). Priority 1: no unit coverage and no asserting end-to-end coverage. Added node:test suites for all three in PR (quality/test-lib-env-helpers branch) covering env-var precedence, SSH/HTTPS URL normalization, REPOSITORY_URL fallback, and prod/deploy-preview branching.

   • [missing-workflow] cncf/techdocs: npm run test:unit (lib/**/*.test.mts) never runs in CI (file path not found at analyzed commit — finding may be outdated) quality

     package.json defines test:unit (node --experimental-strip-types --test 'lib/**/.test.mts') and test (check + test:unit), but no .github/workflows/.yml invokes either. CI currently runs format-check.yml, link-check.yml, spell-check.yml only. lib/remarkRewriteLinks/index.test.mts (existing) and the 3 new suites added in PR test: cover lib/getBuildContext, getCurrentBranch, getGitHubRepoUrl #389 (getBuildContext/getCurrentBranch/getGitHubRepoUrl) can regress silently since nothing in CI ever runs them.

   • [architecture] techdocs#110+Complete gRPC.io domain ownership transfer to LF #151: GA/CSE/Netlify/DNS account-owner records and gRPC.io LF domain transfer both require owner-only credential access, not a repo doc fix (file path not found at analyzed commit — finding may be outdated) scanner

     Record account owners for websites: Google analytics & CSE, Netlify, DNS #110 asks where to record GA/CSE/Netlify/DNS account owners — there is no OWNERS-style file in techdocs for this, and populating one requires someone with admin access to those external accounts to enumerate current owners; it's not inferable from repo content. Complete gRPC.io domain ownership transfer to LF #151 (gRPC.io domain transfer to LF) is purely an external-registrar/DNS administrative action referenced via an email thread, with no corresponding file or config in this repo. Both are marked p1-high/good-first-issue but neither can be resolved by writing or editing a doc — they need a human with the actual account credentials to supply the data or perform the transfer.

   • [test-gap] techdocs#390: confirmed — package.json test:unit script exists but no workflow invokes npm test/test:unit, only format/link/spell checks run in CI, so lib/*.test.mts regressions get green checks #390 scanner

     Verified independently: package.json defines test:unit (node --test over lib/**/*.test.mts) and a combined test script, but .github/workflows/ only contains copilot-setup-steps.yml, format-check.yml, link-check.yml, spell-check.yml, and trigger-contribute-site-netlify.yml — none run npm test or npm run test:unit. lib/remarkRewriteLinks/index.test.mts (and any new suites for lib/getBuildContext.ts etc.) can regress with all CI checks green.

   🟡 MEDIUM (4)

   • [architecture] techdocs#169: removal candidates require deleting CNCF-owned Netlify sites — owner-only action, no techdocs code change possible #169 scanner

     Issue tracks a checklist of CNCF project sites (sig-security-events, foundation-starter-kit, parsec-website, etc.) that may be stale Netlify deployments. Determining 'do we still use it' and deleting a Netlify site requires org-level Netlify dashboard access and a judgment call per project — not something resolvable by editing files in this repo.

   • [docs] techdocs#253: docs/netlify-domains-setup.md documents the process for domain/Netlify handoff but not the requested tracking artifact (which projects/teams/domains exist today) #253 scanner

     CNCF Project Domains, DNS, & Netlify #253 asks the team to track project domain ownership, DNS delegation, and which Netlify teams/projects exist. docs/netlify-domains-setup.md documents the onboarding process (add admins, open LF tickets) but contains no table or list of current domains/teams — the actual tracking artifact the issue requests doesn't exist in-repo (it may live in the external Google Docs runbooks linked from the issue, which isn't verifiable from this repo).

   • [docs] techdocs#153: docs/localization/index.md only lists one example (Japanese) translation, not the requested localization best-practices guide #153 scanner

     Issue Create docs localization guide #153 asks for a localization best-practices guide covering why/when to localize, building translation teams, and tooling changes needed. docs/localization/index.md only states license requirements for guides and lists one example (Japanese) translation — there is no best-practices content at all.

   • [docs] techdocs#283: 'alternative analytics platforms' guidance never written — docs/analytics/index.md only covers GA4/CNCF-managed GA, no non-GA options or picking criteria #283 scanner

     docs/analytics/index.md (restructured from the old docs/analytics.md the issue references) covers only CNCF-managed Google Analytics and GA4 setup via Docsy, plus an archived UA->GA4 migration note. It never discusses non-GA analytics platforms or gives projects criteria for choosing one, which is the issue's original and still-open ask.

   ☑️ Recently Closed — Fix Not Verified (1)

   Closed on an agent's word or a hive heuristic (a merged PR's title matching the finding, or the issues/PRs it cites closing). The hive did not re-check the condition, so it may still hold.

   • test placeholder - to delete test scanner — closed Nov 11 (no evidence recorded), fix not verified

   ---

   Analyzed at cncf/techdocs@4b1f800a8c55 (branch main) — the latest commit when this digest was generated. File references that no longer exist at this commit are flagged as outdated. Findings marked ⚠️ were computed at an older commit and have NOT been re-verified here.

   Updated 11 times · last 2026-11-12T07:39:48Z