Repository navigation
[scanner] bot/hive-docs-refresh is not covered by the Netlify deploy-preview ignore rule, and the #439 gate never runs for GITHUB_TOKEN PRs #506
Description
What
The daily mirror resync added in #499 (.github/workflows/hive-docs-refresh.yml) pushes to bot/hive-docs-refresh. That prefix is not in netlify.toml's [context.deploy-preview].ignore rule (#419), so every daily resync PR builds a Netlify deploy preview. On #500 that preview failed (netlify/hivecommons-docs/deploy-preview, Header rules, Pages changed, Redirect rules all FAILURE on head d46f012), while the four dispatched CI workflows (Build, TypeScript & ESLint, Vitest, npm audit) were green on the same commit. The sibling meeting-recordings-refresh.yml uses automation/…, which the rule already covers.
Why the #439 gate did not catch it
build.yml's "Check bot deploy-preview ignore coverage" step runs only if: github.event_name == 'pull_request'. A PR opened with GITHUB_TOKEN gets action_required on its pull_request runs (never executed), and the refresh workflow re-triggers Build with workflow_dispatch, where the gate step is skipped. So the gate is bypassed for exactly the class of PR it was built for.
Fix
- Add
bot/*to the deploy-preview ignore rule and pinbot/hive-docs-refreshinscripts/check-deploy-preview-ignore.test.ts(PR to follow). - (needs a workflow edit — the hive's App token cannot push
.github/workflows/*) havehive-docs-refresh.ymleither use an already-covered prefix such asautomation/hive-docs-refresh, or also dispatch the gate check for bot PRs so drift is caught before merge. A maintainer should pick one; the netlify.toml change in (1) is sufficient to stop the failing previews on its own.
Evidence: #500 (checks on d46f012), https://github.com/hivecommons/docs/actions/runs/40644429976.
— hive: agent=scanner backend=copilot model=claude-fable-5.1 copilot=1.0.88
Activity
hivecommons-hive commentedon Oct 28, 2026
Correction: the Netlify FAILURE statuses on #500 are the owner-side quota incident ruled informational in #419 (they show on covered lanes too), not a consequence of the lane gap. What remains true:
bot/hive-docs-refreshis not covered by the ignore rule, so the daily resync PR draws on preview quota the rule was written to protect, and the #439 gate cannot catch that for GITHUB_TOKEN-opened PRs. #507 fixes the rule; the workflow-side gate gap still needs a maintainer.— hive: agent=scanner backend=copilot model=claude-fable-5.1 copilot=1.0.88