[hivecommons-hive]

Test Improvement

scripts/add-frontmatter.mjs imports glob, but that package was dropped from package.json devDependencies during an earlier cleanup, leaving the script crashing immediately with ERR_MODULE_NOT_FOUND and zero test coverage in either direction.

This PR:

• Restores glob (^14.0.5) to devDependencies so the script is runnable again.
• Adds scripts/add-frontmatter.test.mjs, a black-box regression suite that runs the script against fixture docs/ files in a temp cwd and asserts on the frontmatter it writes (no heading, no frontmatter, frontmatter without a title, title containing :), plus a guard that the script starts up without the missing dependency.
• Widens the test:unit glob to also pick up scripts/**/*.test.mjs so this new suite actually runs under npm run test:unit.

Verified locally: removing glob from node_modules reproduces the exact ERR_MODULE_NOT_FOUND crash and fails all 5 new tests; reinstalling it makes all 21 unit tests (16 existing + 5 new) pass.

Related Issue

Fixes #391

---

Filed by quality agent (hold-gated mode). Human review required.

— hive: agent=quality backend=copilot model=claude-opus-4-6 copilot=1.0.88

[hivecommons-hive]

Important

Held for human review by the hive's ACMM level gate.

This PR was opened by the "quality" agent while Hive policy required a human checkpoint for that agent. Agent PRs are held at ACMM L3–L5; an outreach PR that targets a repository this hive does not manage is held at every level because it publishes project-facing communication into someone else's project.

Hive will keep the hold label until a human removes it. Operators can make a deliberate one-off release during an ACMM level change with release_level_holds=true, but level changes never release this hold automatically.

[netlify]

✅ Deploy Preview for cncf-techdocs ready!

Name	Link
🔨 Latest commit	7777afd
🔍 Latest deploy log	https://app.netlify.com/projects/cncf-techdocs/deploys/6af50aa89f97692457a00a7d
😎 Deploy Preview	https://deploy-preview-392--cncf-techdocs.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

---

To edit notification comments on pull requests, go to your Netlify project configuration.

[hivecommons-hive]

7777afd

ℹ️ Sentinel notice — informational; author is trusted (hive agent), merge is not blocked

Hive flagged this PR (author @hivecommons-hive[bot], head 7777afd52de7) because it matches behaviors that can override security controls, escalate privileges or damage the codebase. This is a heuristic, not an accusation — a maintainer should confirm the change is intended before it merges.

• sensitive_path — changes 2 sensitive path(s) (Touches a sensitive path (OWNERS, workflows, policies, hive config, security docs, …))
  • package-lock.json
  • package.json

Hive did not add the sentinel-alert label because this author is trusted. The finding remains recorded for audit and the dashboard Security tab; set sentinel.trusted_authors_block: true to require the blocking label for trusted authors too.

[hivecommons-hive]

Verified this end-to-end against the tree. Looks correct to me.

• Confirmed the bug: main's package.json has no glob devDependency, while scripts/add-frontmatter.mjs:2 does import { glob } from 'glob', so the script crashes with ERR_MODULE_NOT_FOUND exactly as #391 describes.
• Read scripts/add-frontmatter.mjs against each assertion in scripts/add-frontmatter.test.mjs: the four fixture cases (no frontmatter, frontmatter without title, colon-quoted title, no-heading no-op) match the script's actual behaviour (processFile, lines 15–81), including the title-insertion-above-existing-keys ordering at line 60.
• Ran npm ci && npm run test:unit on the PR head (7777afd): all 21 tests pass, including the 5 new ones, so the widened test:unit glob in package.json does pick up scripts/**/*.test.mjs.
• The fixture tests run the script with cwd set to a fresh temp dir, so they can't touch real repo docs.

One non-blocking suggestion: the startup-guard test (add-frontmatter.test.mjs:37) runs the script with cwd: tmpdir(). If a docs/ or analyses/ directory ever exists at the OS temp root, the script would mutate real files there. Using a fresh mkdtemp dir for that test too (as the other tests do) would make it fully hermetic. Fine to land as-is.

This matches the scope of #391's recommendation with no unrelated changes (the 80 lockfile lines are the glob@14 subtree). Approval itself is a maintainer's call.

— hive: agent=reviewer backend=copilot model=claude-fable-5 copilot=1.0.88