[thatguywob]

Fixes

Fixes #513

Summary of Changes

Refresh PRs omit Internal Links and Markdown Lint from their explicit CI dispatches, leaving those workflows awaiting approval. Both refresh workflows now dispatch all six checks, and both missing workflows accept workflow_dispatch on the PR branch.

Changes Made

• Added dispatch triggers to Internal Links and Markdown Lint.
• Extended both refresh dispatch lists and their generated PR descriptions.
• Added regression assertions requiring the complete check list and a changelog fragment.

Checklist

• Reviewed the contribution guidelines and performed self-review.
• Added and ran applicable regression tests.
• Updated the refresh PR descriptions.
• Validated the changed workflows locally (details below).
• All CI checks are passing (not awaited).

Security Considerations

• Dockerfiles — not applicable
• Kubernetes manifests — not applicable
• CI/CD workflows — reviewed; dispatches use existing static workflow names, permissions and branch selection; no new credentials or interpolated commands
• Dependencies — not applicable
• Security configs — not applicable

Validation

• Workflow dispatch and changelog tests: 54 passed. Removing the two newly listed checks makes the two new regression assertions fail; restoring the fix passes.
• TypeScript, ESLint (existing warnings only), Markdown lint, internal links (298 checked), Prettier and git diff --check passed.
• Full coverage could not be completed: the sandboxed run encountered subprocess restrictions and was killed (exit 137); an unrestricted run also encountered unrelated DOM test failures/timeouts and was stopped after resource pressure.
• Production build compiled and passed TypeScript, but static page generation timed out and its worker was killed with SIGKILL. Generated mirror/config changes were excluded from this PR.
• typos is unavailable locally.

Reviewer Notes

This adds the dispatch path described in the issue. Live GitHub dispatch behavior requires the change to land; no refresh workflows were triggered during local validation.

— hive: backend=codex

---

🐝 Hive Agent: contributor | SHA: f1f05f1

[netlify]

👷 Deploy request for hivecommons-docs pending review.

Visit the deploys page to approve it

Name	Link
🔨 Latest commit	f1f05f1

[hivecommons-hive]

f1f05f1

⚠️ Sentinel alert — maintainer review required

Hive flagged this PR (author @thatguywob, head f1f05f19f6c5) because it matches behaviors that can override security controls, escalate privileges or damage the codebase. This is a heuristic, not an accusation — a maintainer should confirm the change is intended before it merges.

• sensitive_path — changes 4 sensitive path(s) (Touches a sensitive path (OWNERS, workflows, policies, hive config, security docs, …))
  • .github/workflows/check-internal-links.yml
  • .github/workflows/hive-docs-refresh.yml
  • .github/workflows/markdownlint-cli2.yml
  • .github/workflows/meeting-recordings-refresh.yml

Hive added the sentinel-alert label. While it is present, Hive will not approve this PR, apply LGTM/approval labels, or merge it through any auto-merge lane. Remove the label once reviewed; Hive will not re-apply it unless new commits are pushed. Tune paths and behaviors under sentinel in hive.yaml or the dashboard Security tab.

[hivecommons-hive]

Decision needed: @clubanderson should decide whether this .github/workflows/* change (adding workflow_dispatch to Internal Links and Markdown Lint, and listing both in the refresh dispatch lists) may land — the hive cannot approve workflow edits.

Read the tree, verified the premise, found no defect. Routing only because this edits .github/workflows/* and carries sentinel-alert.

What I checked at f1f05f1:

• The premise in #513 is real. gh api repos/hivecommons/docs/actions/runs?branch=bot/hive-docs-refresh shows on #512 @ 092ce6b: Internal Links (40829898572) and Markdown Lint (40829898696) pull_request runs are action_required, while Build/TypeScript & Lint Check/Vitest/npm audit all have green workflow_dispatch runs — exactly the four names in the pre-PR REQUIRED_CHECK_WORKFLOWS (hive-docs-refresh.yml:21, meeting-recordings-refresh.yml:16).
• The fix mirrors the pattern the repo already uses: build.yml:8-11 has the same workflow_dispatch: trigger with the same (#335, #337) rationale. The dispatch loop (hive-docs-refresh.yml:84-87) iterates $REQUIRED_CHECK_WORKFLOWS with gh workflow run "$wf" --ref "$REFRESH_BRANCH", so adding two filenames to the list is sufficient.
• No permission change. Both newly-dispatchable workflows declare permissions: read-all (check-internal-links.yml:45, markdownlint-cli2.yml:16) and the refresh job already held actions: write (hive-docs-refresh.yml:26). No new secrets, no new interpolation into run:.
• src/__tests__/refresh-workflow-dispatch.test.ts:58-69 pins all six names for both refresh workflows; Run unit tests is green on this head.

Body matches diff; Fixes #513 is the right link semantics (the issue is fully resolved by this change).

One open question, not a defect: I could not read branch protection (403 for the App), so I cannot confirm Check internal doc links / markdownlint are required checks on main. It does not change the conclusion — the merge relay's ci gate rejects on any action_required run regardless of protection — but if they are not required, the maintainer may prefer dropping them from the list rather than dispatching them.

I have not approved or merged anything; this needs a human on the workflow files.

— hive: agent=reviewer backend=copilot model=claude-fable-5.1 copilot=1.0.88

[hivecommons-hive]

Decision needed: @clubanderson should decide whether to accept this workflow-trigger change (adds workflow_dispatch to two CI workflows and extends the refresh dispatch lists) — it carries sentinel-alert and touches .github/workflows/, so the trust call is yours.

Routing to a maintainer: the change reads correct to me, but it edits .github/workflows/ and carries sentinel-alert, so a human has to sign it.

What I verified against the tree at f1f05f1:

• check-internal-links.yml:11 and markdownlint-cli2.yml:4 gain workflow_dispatch: only. Neither job reads github.event.pull_request — check-links runs npm ci / sync / npm run check-links on the checked-out ref, markdownlint runs the action on static globs — so both behave identically when dispatched on the PR branch. Permissions stay read-all; no new secrets, no interpolated input.
• hive-docs-refresh.yml:21 and meeting-recordings-refresh.yml:16 extend REQUIRED_CHECK_WORKFLOWS; the dispatch loop at hive-docs-refresh.yml:84-87 (gh workflow run "$wf" --ref "$REFRESH_BRANCH") is unchanged and already iterates the list, so no new code path.
• This mirrors the pattern already in build.yml:8-11 exactly as #513 prescribed.
• The relay question I had — do the held pull_request runs still block even with a green dispatched twin? — is answered by #512 @ 092ce6b: Build, Vitest, TypeScript & Lint Check, npm audit also have action_required pull_request runs there, yet the relay only named Internal Links and Markdown Lint. So a successful workflow_dispatch run of the same workflow satisfies the gate, and this fix will clear it.
• Test: refresh-workflow-dispatch.test.ts:58-69 is the regression guard; the existing it.each(required) cases (:76-91) extend automatically to the two new entries. The comment lines inserted under on: are skipped by readTriggers (only ^ {2}key: matches), so the parser is unaffected.

Nothing to flag; the PR body matches the diff. I have not approved or merged anything.

— hive: agent=reviewer-2 backend=copilot model=claude-fable-5.1 copilot=1.0.88

[hivecommons-hive]

Needs a decision, not a merge:

• the reviewer swarm returned requires_human @f1f05f1
• reviewer question: @clubanderson should decide whether this .github/workflows/* change (adding workflow_dispatch to Internal Links and Markdown Lint, and listing both in the refresh dispatch lists) may land — the hive cannot approve workflow edits.
• a sentinel alert is open on this PR
• the automerge lane will not merge this unattended

Head: verdict requires_human @f1f05f1, 4/4 checks green, DCO yes, sentinel alert, soak 7m0s of 30m0s.

How to release it:

• After reading the verdict, a trusted merger can submit a GitHub Approve review for the current head and the lane clears the hold on its next pass; /hive approve replies on a PR are acknowledged but not consumed. An ordinary contributor cannot release their own PR.
• Resolve the sentinel alert and have a maintainer clear its label.

_{Clear the cause and the hive re-evaluates on its next pass; the stage moves to stage/090-ready-for-human-merge, stage/095-pre-merge-soak or the merge queue on its own. Approval does not bypass CI, hold labels or other merge gates.}

[hivecommons-hive]

Needs a decision, not a merge:

• the reviewer swarm returned requires_human @f1f05f1
• reviewer question: @clubanderson should decide whether to accept this workflow-trigger change (adds workflow_dispatch to two CI workflows and extends the refresh dispatch lists) — it carries sentinel-alert and touches .github/workflows/, so the trust call is yours.
• a sentinel alert is open on this PR
• the automerge lane will not merge this unattended

Head: verdict requires_human @f1f05f1, 4/4 checks green, DCO yes, sentinel alert, soak 12m0s of 30m0s.

How to release it:

• After reading the verdict, a trusted merger can submit a GitHub Approve review for the current head and the lane clears the hold on its next pass; /hive approve replies on a PR are acknowledged but not consumed. An ordinary contributor cannot release their own PR.
• Resolve the sentinel alert and have a maintainer clear its label.

_{Clear the cause and the hive re-evaluates on its next pass; the stage moves to stage/090-ready-for-human-merge, stage/095-pre-merge-soak or the merge queue on its own. Approval does not bypass CI, hold labels or other merge gates.}

[hivecommons-hive]

/lgtm

Posted by @clubanderson from the Hive dashboard; the merge gate decides from here.

[kubestellar-prow]

@hivecommons-hive[bot]: changing LGTM is restricted to collaborators

Details

In response to this:

/lgtm

Posted by @clubanderson from the Hive dashboard; the merge gate decides from here.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[hivecommons-hive]

/approve

Posted by @clubanderson from the Hive dashboard; the merge gate decides from here.

[kubestellar-prow]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: hivecommons-hive[bot]
Once this PR has been reviewed and has the lgtm label, please assign clubanderson for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[hivecommons-hive]

@clubanderson approved head f1f05f19f6c5, which edits CI workflow / action files. That explicit owner approval releases the contributor lane's workflow-path fence: the hive merges this PR itself once the usual gates (CI, soak, holds, review verdict) are clear. A new push re-arms the fence until the new head is approved again.

[hivecommons-hive]

Evidence bundle `#514f1f05f1` sha256:45663d11e4402e59f12d90ef18e4122f48e586fbd6ccbd14f8fa1b9c09ba5fe1 — download from the dashboard or `hivectl review evidence #514`.

[hivecommons-hive]

Merged by hive contributor-lane auto-merge: CI green for ≥30m, reviewer verdict not required, @clubanderson approved this head as the owner decision (admitted_by: operator-approval:clubanderson) — merged as-is on that approval.