Repository navigation
Review backlog (security): Refs-only contributor PRs are again surfaced with an operator close action #14869
Description
Blocked on PR #14862. This finding came from reviewing PR #14862 and is about code that PR is changing. Fix it in the PR, or leave it: the hive lifts the block when the PR merges, and unblocks this item for re-triage if the PR is closed without merging. Once it is unblocked, check the finding still applies on the base branch; if it is already fixed, close this item without a PR.
Filed from an out-of-scope finding in the Hive review of PR #14862.
PR: #14862 (#14862)
Perspective: security
Severity: low (P3)
Evidence: src/pkg/github/pr_supersession_sweep.go:223 (
hive/src/pkg/github/pr_supersession_sweep.go
Line 223 in 00ab642
Finding: Refs-only contributor PRs are again surfaced with an operator close action
Commit 00ab642 drops the candidate.Closing gate on the detected-contributor audit (sweep.go:186, :223), so a PR that only says Refs #N is recorded as detected; the tracker then captions it 'close as superseded or keep open' (api_review_queue_superseded.go:174) and POST .../superseded/close will close it (api_review_queue_superseded.go:216-249). The close is operator-authenticated and the automatic path still passes candidate.Closing (sweep.go:239), and this restores v5 base behavior rather than introducing it, so it is not a security regression — but the tracker offering a close for a PR that never claimed the issue is a UX/correctness concern worth a follow-up.
Fingerprint: 1abab72671fe89127e0c6013dd71998e1798cee9d2af2fc38970c82ae3e9fdd2
filed by Hive review backlog
Activity
hivecommons-hive commentedon Oct 28, 2026
Unblocked: source PR #14862 closed unmerged — re-triage against current base. A superseding PR often lands the same lines, so the finding may still apply; close this item only if it no longer does.
hivecommons-hive commentedon Oct 28, 2026
Unblocked: #14862 is no longer open. This issue is actionable again.
hivecommons-hive commentedon Oct 28, 2026
Checked on
v5after blocker #14862 closed unmerged:src/pkg/github/pr_supersession_sweep.go:222on v5 still gates the detected-contributor audit oncandidate.Closing, so Refs-only contributor PRs are not surfaced with a close action on the base branch. The change lives in open #14821; flagged there for the author so it is addressed before merge. Closing as not planned.🐝 Hive Agent:
scanner| Instance:hosted-available-oke-11-placeholder-r05x| SHA:unknown— hive: agent=scanner backend=copilot model=claude-fable-5.1 copilot=1.0.88