[clubanderson]

Fixes #14589

What

When a GitHub App API call that is a prerequisite for the lane's progress fails with 403 Resource not accessible by integration, the hive now says so plainly instead of warning every tick and silently waiting:

• Generic helper markUnauthorized(ctx, repo, pr, head, step, permission, humanAction) / clearUnauthorized in src/pkg/github/automerge/automerge_unauthorized.go: adds hive:unauthorized, posts one idempotent comment per (head, step) (<!-- hive:unauthorized head=<sha> step=<step> -->) naming the exact missing permission and the exact human step, logs once per head at INFO (msg="lane unauthorized"), returns reason unauthorized:<step>.
• Wired: held-run approval from ✨ feat(automerge): approve held workflow runs for registry-trusted contributors #14520 (approveHeldRunsForRegistryTrusted) — needs actions: write; the comment says to click Approve and run and lists the run ids and the missing required check. Cleared in the same tick the required checks for the head report (no human label edit).
• Stage engine: unauthorized:* → 085 with the reason kept; the 085 entry comment (decisionCause) names the refused step.
• Dashboard: unauthorized modifier (label-driven, like stalled/hold/draft), muted pill (dashed, --text-muted), tooltip from payload unauthorized, counted under Needs attention; the 085 cell and caption read Awaiting human: approve workflow runs (payload unauthorized_step). hive:unauthorized joins the needs-human label preset.
• Other 403 sites (automerge_contributor_adopt.go close-PR, automerge_sweep.go update-branch, automerge_merge_forward.go) are ambiguous (fork editability / rate limit / archived) and carry TODO(hivecommons/hive#14589) comments rather than being wired.
• Docs: labels-and-control-signals (label lifecycle row), dashboard-sections (pill), github-app-setup (actions: write is optional; without it the hive marks unauthorized and waits). Changelog fragment changelog.d/added-unauthorized-label.md.

Tests

Table-driven, no time.Sleep:

• TestContributorLaneUnauthorizedWhenApproveForbidden: 403 → label + 1 marker comment + reason set once; second tick same head → no duplicate; checks appear → label removed and state cleared in that tick; restart case (label + marker already present) re-posts nothing.
• Non-403 approve error (500) → no label, no comment, reason unchanged.
• TestIsResourceNotAccessible, TestUnauthorizedCommentAndMarker, TestClassifyStageUnauthorizedParksForMaintainer, dashboard modifier/payload/caption tests and a node-run pill/tooltip/gate-word check.

[kubestellar-prow]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign clubanderson for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[hivecommons-hive]

@clubanderson is auto-promoted for contributor-lane merging on this PR: the last 5 merged PRs by this author in this hive's repositories have no revert or sentinel-alert evidence. CI, reviewer verdict, diff fences, soak, holds and branch protection still apply.

[hivecommons-hive]

@clubanderson this PR is held at stage/071-needs-author and the hive will not merge it yet.

Failing checks:

• test (rest 1/4)

Next: the hive does not push to your branch. Push a new head (or reply here); CI and the review swarm re-run automatically and the PR returns to the normal path.

[github-actions]

Open PR overlap check

Base branch: v5

Conflicts are checked with every PR merged onto the current tip of v5, so a PR that only needs a rebase is not reported as conflicting with its siblings.

PR	Title	Relation	Files
#14573	✨ feat(dashboard): show a draft pill in the activity tracker	CONFLICT	src/pkg/dashboard/stage_tracker.go src/pkg/dashboard/static/index.html
#14597	🐛 fix(dashboard): show the fleet running · $/hour figure in the visible Governor grid	same files	src/pkg/dashboard/static/index.html
#14582	✨ House-style section every kick opens with: repo HIVE_STYLE.md > hive default > built-in	same files	src/pkg/dashboard/static/index.html

[hivecommons-hive]

Another agent tried to open a PR from scanner/fix-14589, but this PR already closes #14589. No second PR was opened; please continue here, or rebase the new work onto this branch.

[hivecommons-hive]

Read at 9792784 against the tree. The core mechanism is sound; one small text/behaviour mismatch worth fixing before merge.

Verified correct

• The new label cannot block its own lane: labelBlockReason (automerge_sweep.go:1935–1953) only reacts to sentinel / needs-rebase / needs-human / do-not-merge* / hold labels, so hive:unauthorized on the PR does not make approveHeldRunsForRegistryTrusted bail and then clearUnauthorized strip the label on the next tick.
• Restart path: contributorHeldRunsApprovalAttempted is in-memory, so after a restart the approve is retried and 403s again, but markUnauthorized (automerge_unauthorized.go:118–143) skips the label when pr.Labels already carries it and commentUnauthorized returns on the existing <!-- hive:unauthorized head=… step=… --> marker — no duplicate, as the test asserts.
• Clear is tied to the step, not the label: automerge_contributor_lane.go:1259–1267 clears whenever the reason stops being unauthorized:* (checks appeared, head moved, or green), and clearUnauthorized (:150–172) leaves a mark for a different step alone.
• isResourceNotAccessible requires both 403 and the integration body, so rate-limit / archived 403s are not misclassified.

Finding (low) — automerge_unauthorized.go:211: the posted note ends with "this label and note clear themselves", but nothing in the PR deletes or edits the comment (clearUnauthorized only removes the label; no DeleteComment/EditComment anywhere in the diff). The note is also the idempotency marker, so deleting it would be wrong — the fix is the wording: "this label clears itself" (or say the note stays as a record). labels-and-control-signals.md says "pill, label and payload fields clear themselves", which is accurate; only the comment text over-promises.

Not approving (human signature), but with that one line changed I see nothing else blocking.

— hive: agent=reviewer backend=copilot model=claude-fable-5.1 copilot=1.0.88

[hivecommons-hive]

Evidence bundle `#145959792784` sha256:c54868ef799f35ad3629bff568c62a09648031763f857f9f16cc579fd9bb0419 — download from the dashboard or `hivectl review evidence #14595`.

[hivecommons-hive]

merged by Hive trusted-author auto-merge: author @clubanderson holds role owner and GitHub permission admin on repo; CI green at 9792784.

[github-actions]

Thank you for your contribution! Your PR has been merged.

We'd love to hear how your experience was: share feedback