[scanner] community-groups.json has no refresh automation; validator comments cite a nonexistent wiring and closed issue #122 #1386

Activity

1. hivecommons-hive

   added

   bugSomething isn't workingSomething isn't working

   hive/hosted-available-lke648397-260827-5n31

   agent/scannerApproved by a Hive merger/owner for auto-merge on green CIApproved by a Hive merger/owner for auto-merge on green CI

   🐝 covered by PRHive verified that an open PR references or claims this issue; still actionable until confirmedHive verified that an open PR references or claims this issue; still actionable until confirmed

   on Oct 13, 2026
2. hivecommons-hive commented on Oct 13, 2026

   

   hivecommons-hiveBot

   on Oct 13, 2026 – with hivecommons-hive

   ContributorAuthor

   More actions

   Status: the PR-able half (Part 2, stale validator comments in scripts/validate-community-groups.mjs and scripts/validate-community-people.mjs) is covered by held PR #1387. The remaining Part 1 — wiring npm run check:community-group-links + validate:community-groups into .github/workflows/refresh-community-people.yml — lives under .github/workflows/, which the scanner tier cannot push (GitHub rejects workflow diffs without the workflows permission); it needs a human or an ISSUES_PRS_MERGE agent to land, using the exact replacement text in this issue body.

   ---

   🐝 Hive Agent: scanner | Instance: hosted-available-lke648397-260827-5n31 | SHA: unknown

   — hive: agent=scanner backend=copilot model=kimi-k3 copilot=1.0.88
3. hivecommons-hive commented on Oct 13, 2026

   

   hivecommons-hiveBot

   on Oct 13, 2026 – with hivecommons-hive

   ContributorAuthor

   More actions

   Consolidated finding. This was filed as a separate issue; it references exactly the same files as this one (check-community-group-links.mjs, ci.yml, data/community-groups.json, data/community-people.json, deploy-gh-pages.yml, github/workflows/refresh-community-people.yml, scripts/validate-community-groups.mjs, scripts/validate-community-people.mjs, tests/workflow-scripts.test.mjs), so it was folded in here instead. Address it in the same PR as this issue — two PRs editing the same files would conflict.

   [sec-check] No Referrer Policy: 16 off-origin loads beacon the site origin to GitHub on every page view

   Finding

   data/community-groups.json (the freshness/drift signal behind the
   GroupLinkStatus component and validate:community-groups) is never
   refreshed by any automation, and two validator comments misdocument why.

   1. The documented refresh path does not exist.
   scripts/validate-community-groups.mjs (lines 100-106) says:

   refresh-community-people.yml is the only workflow that re-runs
   check-community-group-links.mjs, and it cannot open a PR while #122 ... is
   unresolved

   No workflow runs it — grep -r "community-group-links" .github/workflows/
   matches only the validate:community-groups steps in ci.yml and
   deploy-gh-pages.yml, and git log -S 'check:community-group-links' -- .github/workflows shows no workflow ever ran it. The weekly
   refresh-community-people.yml runs fetch:community-people,
   fix:format, validate:community-people, test:unit, build — nothing
   else.

   2. The #122 premise is obsolete in both validators.
   Issue #122 (repo blocking GITHUB_TOKEN from opening PRs) was closed
   2026-09-23, and the weekly refresh demonstrably works now:
   data/community-people.json carries fetchedAt: 2026-10-05, produced by
   the Monday 02:37 UTC cron. But:

   • scripts/validate-community-people.mjs (lines 122-128) still says
     "fetchedAt is frozen and will only get staler until that repo-level
     setting is flipped", and defers flipping STALENESS_SEVERITY back to
     'error' on [ci-maintainer] Refresh community profiles fails weekly: repo blocks GITHUB_TOKEN from creating PRs #122 being resolved — which it now is.
   • scripts/validate-community-groups.mjs (lines 100-106) uses the same
     closed issue to justify warn-only staleness for a data file nothing
     refreshes.

   Consequence. data/community-groups.json has had
   checkedAt: 2026-09-23 since it was committed in #411. Around
   2026-11-22 it crosses the 60-day warn threshold permanently, the
   "Upstream group links last verified on …" note on the community page ages
   forever, and an archived/renamed upstream group repo is never detected
   unless someone happens to run npm run check:community-group-links by
   hand.

   Recommendation

   Two parts; the first touches .github/workflows/ and therefore needs a
   human (or an agent tier with the Workflows permission) to land — the
   scanner tier cannot push workflow changes.

   Part 1 (needs human): wire the refresh into the working weekly pipeline.
   In .github/workflows/refresh-community-people.yml:

         - run: npm run fetch:community-people
   +     - run: npm run check:community-group-links
   +       env:
   +         GH_TOKEN: ${{ github.token }}
         - run: npm run fix:format
         - run: npm run validate:community-people
   +     - run: npm run validate:community-groups
         - run: npm run test:unit

   check-community-group-links.mjs already accepts GH_TOKEN/GITHUB_TOKEN,
   writes the data file deterministically, and the existing
   create-pull-request step then carries the refreshed file. This also
   satisfies the GATES_NOT_RUN_BY_CI exemption's spirit: the entry in
   tests/workflow-scripts.test.mjs says the gate is exempt because "it …
   rewrites data/community-groups.json, which is a refresh job" — this wires
   it into exactly that refresh job.

   Part 2 (PR-able now): correct the two stale comments.

   In scripts/validate-community-groups.mjs, replace the TODO(#122) block
   with text reflecting that no workflow refreshes the file yet (this issue's
   Part 1), so the warn-only rationale stops citing a closed issue and a
   nonexistent wiring.

   In scripts/validate-community-people.mjs, replace the TODO(#122) block to
   record that #122 is closed and the weekly refresh is healthy; whether
   STALENESS_SEVERITY should now flip to 'error' (the flip the comment
   deferred on #122) is a maintainer call — the conservative change keeps
   'warn' and says so.

   ---

   Filed by scanner agent (ACMM L5 — hold-gated mode)

   ---

   🐝 Hive Agent: security | Instance: hosted-available-lke648397-260827-5n31 | SHA: f5586b0

   — hive: agent=sec-check backend=copilot model=claude-opus-5 copilot=1.0.88
4. hivecommons-hive commented on Oct 13, 2026

   

   hivecommons-hiveBot

   on Oct 13, 2026 – with hivecommons-hive

   ContributorAuthor

   More actions

   Correction: the "[sec-check] No Referrer Policy…" title appended to this issue above was a mis-consolidation on my side, not a finding about this issue's subject. A heredoc writing my issue body failed on a path I did not own, so the body submitted here was this issue's own text, and the hive matched it as a duplicate.

   Nothing in this issue's scope has changed — data/community-groups.json refresh wiring and the two stale #122 comments are unaffected. The referrer-policy finding was re-filed correctly as #1402 (fix in #1403) and touches only docusaurus.config.js and tests/site-config.test.mjs. Apologies for the noise.

   ---

   🐝 Hive Agent: security | Instance: hosted-available-lke648397-260827-5n31 | SHA: f5586b0

   — hive: agent=sec-check backend=copilot model=claude-opus-5 copilot=1.0.88
5. hivecommons-hive

   added

   hive/likely-doneHive verified that a merged PR references or claims this issue; pending confirmationHive verified that a merged PR references or claims this issue; pending confirmation

   and removed

   🐝 covered by PRHive verified that an open PR references or claims this issue; still actionable until confirmedHive verified that an open PR references or claims this issue; still actionable until confirmed

   on Oct 13, 2026
6. hivecommons-hive commented on Oct 13, 2026

   

   hivecommons-hiveBot

   on Oct 13, 2026 – with hivecommons-hive

   ContributorAuthor

   More actions

   A merged PR referenced this issue without closing it. Carrying the remainder back here so the issue timeline shows what is still open.

   • docs(scripts): correct stale #122 premises in community data validator comments #1387 — docs(scripts): correct stale [ci-maintainer] Refresh community profiles fails weekly: repo blocks GITHUB_TOKEN from creating PRs #122 premises in community data validator comments (docs(scripts): correct stale #122 premises in community data validator comments #1387) — needs human

   Remainder from the PR body:

   workflow step in .github/workflows/refresh-community-people.yml

   This comment is edited in place by the task-list sweep on every cycle; it is not duplicated.
7. hivecommons-hive

   added

   needs-human

   on Oct 13, 2026
8. hivecommons-hive commented on Oct 13, 2026

   

   hivecommons-hiveBot

   on Oct 13, 2026 – with hivecommons-hive

   ContributorAuthor

   More actions

   What to reply

   • /hive approve: go with the recommendation
   • /hive decision <your instructions>: go ahead, following your instructions
   • /hive help: show these again

   If this issue is waiting only for reporter confirmation after a merged fix, the reporter or a maintainer can reply /fixed instead.

   Only a maintainer with write access can un-park; everything else is ignored. Full command reference: https://github.com/hivecommons/hive/blob/v5/src/docs/maintainer-commands.md.
9. mrbobbytables

   closed this as completedin #1405on Oct 13, 2026
10. mrbobbytables

    added a commit that references this issue on Oct 15, 2026

    ci(refresh): re-run community group link checks in the weekly refresh…

    ...

    This issue will close once commit 1673b63 is merged into the 'main' branch.

    1673b63