[mrbobbytables]

Fix

Part 1 of #1386, the half that needed workflow-push rights. data/community-groups.json was never refreshed by any automation; #1387 (merged) corrected the comments, this wires the refresh.

.github/workflows/refresh-community-people.yml:

• npm run check:community-group-links (with GH_TOKEN: ${{ github.token }}) after fetch:community-people, before fix:format
• npm run validate:community-groups after validate:community-people
• PR title/commit/body updated to say it carries group status too

The ordering contract in tests/automation-workflow-ordering.test.mjs (generate, format, validate, test) is preserved. With #1396 merged, a run where every upstream check is inconclusive exits 1 before writing, so this job fails loudly rather than opening a PR with a hollow report.

Also:

• Deleted the check:community-group-links entry from GATES_NOT_RUN_BY_CI in tests/workflow-scripts.test.mjs, which its own "no exemption names a gate a workflow already runs" guard now demands.
• scripts/validate-community-groups.mjs staleness comment no longer says no workflow runs the check.
• CONTRIBUTING.md data-model entry notes the weekly refresh.

Verification

npm run test:unit:coverage:check: 2548 pass, coverage gate green. check:spelling, markdownlint, prettier --check clean on the touched files.

Closes #1386

[hivecommons-hive]

d6acc26

ℹ️ Sentinel notice — informational; author is trusted (owner), merge is not blocked

Hive flagged this PR (author @mrbobbytables, head d6acc26347b3) because it matches behaviors that can override security controls, escalate privileges or damage the codebase. This is a heuristic, not an accusation — a maintainer should confirm the change is intended before it merges.

• sensitive_path — changes 1 sensitive path(s) (Touches a sensitive path (OWNERS, workflows, policies, hive config, security docs, …))
  • .github/workflows/refresh-community-people.yml

Hive did not add the sentinel-alert label because this author is trusted. The finding remains recorded for audit and the dashboard Security tab; set sentinel.trusted_authors_block: true to require the blocking label for trusted authors too.

[hivecommons-hive]

Verified against the tree at merge-base (1e37cdc) and ran the suites on this head.

• The emptied GATES_NOT_RUN_BY_CI is consistent: tests/workflow-scripts.test.mjs ("every validate:/check: gate is run by a workflow or recorded as exempt") now finds check:community-group-links via the new run step in refresh-community-people.yml, and the exemption-vs-already-run guard would indeed fail if the entry had stayed. Ran node --test tests/workflow-scripts.test.mjs on this head: 18 pass, 0 fail.
• The "refuses to write" claim in the updated scripts/validate-community-groups.mjs comment is accurate: scripts/check-community-group-links.mjs:74-79 exits 1 before writeFileSync when every check is inconclusive.
• Step ordering is sound: the checker rewrites data/community-groups.json before fix:format and validate:community-groups run, so the opened PR carries formatted, validated output. GH_TOKEN: ${{ github.token }} is scoped to the one step that needs it; workflow permissions are unchanged.
• node scripts/validate-community-groups.mjs passes on this head.

Note for the deciding maintainer: this edits a workflow with contents: write / pull-requests: write (refresh-community-people.yml:8-10), so it is a trust-surface change by file class. The added steps only run existing package.json scripts and grant no new permissions, but workflow changes deserve a human sign-off. Looks correct to me.

— hive: agent=reviewer backend=copilot model=claude-fable-5 copilot=1.0.88