[hivecommons-hive]

Test Improvement

deployment.yaml rolls the pods on a ConfigMap or inline-Secret change through checksum/config and checksum/secret, passes six placement/pod values through, and _helpers.tpl:10 keeps a release name that already contains the chart name unsuffixed. No helm-unittest suite asserted any of it and the kind installs in test.yml (ci/*.yaml) set none of those values, so dropping github.apiUrl from the config digest, deleting the nodeSelector block, killing the fullname contains arm or removing checksum/secret all passed the 41 existing tests. Each of those four mutations now fails at least one new case (checked locally with helm 4.0.0 + helm-unittest 1.2.1; 5 suites / 51 tests green, npx eslint charts/prow-github-app/tests/*.yaml clean).

The checksum cases pin the sha256 digests for the fixture values; a comment in topology_test.yaml gives the one-liner that reproduces them, since adding a prow.* key to values.yaml moves the default digest on purpose.

Files: charts/prow-github-app/tests/placement_test.yaml (new), tests/topology_test.yaml (checksum cases appended), tests/wiring_test.yaml (release-name case appended). No template or src/ change.

Related Issue

Closes #665

---

Filed by quality agent (hold-gated mode). Human review required.

— hive: agent=quality backend=copilot model=claude-fable-5.1 copilot=1.0.88

[hivecommons-hive]

Important

Held for human review by the hive's ACMM level gate.

This PR was opened by the "quality" agent while Hive policy required a human checkpoint for that agent. Agent PRs are held at ACMM L3–L5; an outreach PR that targets a repository this hive does not manage is held at every level because it publishes project-facing communication into someone else's project.

Hive will keep the hold label until a human removes it. Operators can make a deliberate one-off release during an ACMM level change with release_level_holds=true, but level changes never release this hold automatically.

[hivecommons-hive]

e849744

ℹ️ Sentinel notice — informational; author is trusted (hive agent), merge is not blocked

Hive flagged this PR (author @hivecommons-hive[bot], head e849744d5cf5) because it matches behaviors that can override security controls, escalate privileges or damage the codebase. This is a heuristic, not an accusation — a maintainer should confirm the change is intended before it merges.

• sensitive_path — changes 3 sensitive path(s) (Touches a sensitive path (OWNERS, workflows, policies, hive config, security docs, …))
  • charts/prow-github-app/tests/placement_test.yaml
  • charts/prow-github-app/tests/topology_test.yaml
  • charts/prow-github-app/tests/wiring_test.yaml

Hive did not add the sentinel-alert label because this author is trusted. The finding remains recorded for audit and the dashboard Security tab; set sentinel.trusted_authors_block: true to require the blocking label for trusted authors too.

[hivecommons-hive]

Looks correct to me — verified locally, not just read.

• Re-ran the suite at head e849744 with helm v4.0.0 + helm-unittest 1.2.1: 5 suites / 51 tests pass, so the pinned sha256 digests in tests/topology_test.yaml match what deployment.yaml:24-26 actually renders from the default values.yaml prow block.
• Spot-checked two of the four claimed mutation kills: dropping .Values.github.apiUrl from the checksum/config list (deployment.yaml:24) fails 5 tests including the new apiUrl-roll case, and deleting the contains arm in _helpers.tpl:10-12 fails exactly the new "release named after the chart is not suffixed" case in tests/wiring_test.yaml. Both mutations pass the pre-existing 41 tests, confirming the gap the PR body and #665 describe.
• The existingSecret case correctly clears all three inline creds so the schema/template take the checksum/secret: {{- if not .Values.github.existingSecret }} branch (deployment.yaml:25), and cronjob.yaml:5 does render <fullname>-jobs, matching the prow-github-app-prod-jobs assertion.

Tests-only change, no template or src/ edits, CI green. Matches the scope of #665 exactly. The hold label is the only thing between this and merge — a maintainer lift is all it needs.

— hive: agent=reviewer backend=copilot model=claude-fable-5 copilot=1.0.88

[hivecommons-hive]

/kind cleanup

---

🐝 Hive Agent: quality | Instance: hosted-available-lke648397-260827-5q9t | SHA: 19d23da

— hive: agent=quality backend=copilot model=claude-fable-5.1 copilot=1.0.88