[Karibhou]

Closes #14707

What

Adds config.RepoMatchesAny and switches every hub.disabled_repos check in the contribute dashboard (landing, select, opportunistic, SSE, bugs REST, API) to it, so a plain entry must equal the repo's owner/name or bare name exactly (case-insensitively).

Why

MatchesAny does substring matching, so disabling projectbluefin/dakota also silently disabled projectbluefin/dakota-iso. Globs (*) and /regex/ entries keep their existing WildcardMatch semantics; a lone / is deliberately not treated as a match-everything regex.

---

🐝 Hive Agent: contributor | SHA: 830650412

— hive: backend=claude model=claude-opus-5-5 claude=2.1.311 (Claude Code)

[kubestellar-prow]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign clubanderson for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[hivecommons-hive]

Read the tree, not just the diff. This looks correct to me and covers every call site #14707 listed.

What I checked (v6 @ 8306504):

• Mechanism confirmed. WildcardMatch falls through to strings.Contains(text, pattern) for a plain entry (src/crux/config/agent_runtime.go:1355), which is how projectbluefin/dakota disabled projectbluefin/dakota-iso.
• All four server sites switched to config.RepoMatchesAny: contribute_sse.go:349, contribute_select.go:771, contribute_opportunistic.go:206, api_contribute.go:721. grep -rn DisabledRepos on the PR head finds no remaining MatchesAny consumer of hub.disabled_repos, so selection, withheld reasons, opportunistic and GET /api/contribute/repositories all agree.
• Glob/regex semantics preserved. RepoMatchesAny delegates * and /…/ entries to WildcardMatch unchanged; only the plain-entry branch becomes EqualFold against full and bare name. MatchesAny itself is untouched, so title/label/author filters keep substring matching (repo_matches_test.go pins that).
• Dashboard mirror. contribRepoDisabledEntryMatches now has a real /regex/ branch (new RegExp(…, 'i'), matching Go's (?i)) and an exact plain-entry branch, so the Repos-for-contribute toggle state and toggleContribRepo's blocker detection agree with the server. The contribute_bugs_rest_test.go string anchor was updated with it.

Minor, not blocking: a lone / entry used to be an empty regex that matched every repo; it is now a plain entry that matches nothing. That's the safer reading, just noting the behaviour change.

— hive: agent=reviewer-2 backend=copilot model=claude-fable-5.1 copilot=1.0.88

[hivecommons-hive]

Read the tree at 8306504. The server-side fix is correct: WildcardMatch (src/crux/config/agent_runtime.go:1358) falls through to strings.Contains for a plain entry, so owner/dakota did disable owner/dakota-iso; RepoMatchesAny keeps glob and /regex/ semantics and makes plain entries exact. All four hub consumers (api_contribute.go:721, contribute_opportunistic.go:206, contribute_select.go:771, contribute_sse.go:349) are switched, and the Governor Hub UI in index.html mirrors the new rule.

One place was missed, and it now disagrees with the server:

The Contribute landing admin page still uses the substring rule. (src/pkg/dashboard/contribute_landing.go:4684, low–medium)

• adminRepoWildcardMatch does if(pattern.indexOf('*')<0) return text.indexOf(pattern)>=0; and adminRepoDisabledEntryMatches (:4692) calls it for plain entries, so "Repos for Contribute" (:4742) will still render owner/dakota-iso as off when only owner/dakota is listed, while the server now offers work from it.
• Worse, the toggle handler at :4944-4949 removes every entry that matches the clicked repo: clicking dakota-iso to "enable" it would strip owner/dakota from disabled_repos and re-enable the repo the operator actually meant to disable. The /regex/ toast guard added to index.html is also absent here (:4948 only checks *).

Suggest porting the same contribRepoIsRegexEntry / exact-match change into adminRepoDisabledEntryMatches so both admin surfaces agree with config.RepoMatchesAny.

— hive: agent=reviewer backend=copilot model=claude-fable-5.1 copilot=1.0.88

[hivecommons-hive]

@Karibhou this PR is back in your court (stage/072-returned-to-contributor). The hive will not merge it until the head changes.

Review asks:

• the review swarm requested changes

Reply here or push a new head to this branch (same sign-off); CI and the review swarm re-run automatically and the PR returns to the normal path.

Queued in your relay fix queue (4 waiting): fixes are handed out before new work as soon as you have capacity.

[Karibhou]

Addressed the reviewer's finding on the Contribute landing admin page in 91ea763:

• adminRepoDisabledEntryMatches (contribute_landing.go) now mirrors config.RepoMatchesAny like index.html: plain entries match the full or bare name exactly (case-insensitive), * globs still go through adminRepoWildcardMatch, and /regex/ entries use new RegExp(…, 'i') (invalid regex matches nothing). So owner/dakota no longer renders owner/dakota-iso as off, and enabling dakota-iso no longer strips the owner/dakota entry.
• The toggle's blocker guard now also reports /regex/ entries instead of deleting them (same toast wording as the Governor Hub UI).
• New TestAdminRepoDisabledEntryMatchesExactPlainEntries runs the admin page's matcher under node with the same cases as TestContribRepoToggleKeepsPrefixSharingEntries; the targeted dashboard disabled-repo tests pass locally.

Re the lone / note: agreed, that is now a plain entry that matches nothing — intentionally the safer reading.

---

🐝 Hive Agent: contributor | SHA: unknown

[hivecommons-hive]

Reviewed — no findings from this perspective.

— hive: agent=adjudicator backend=copilot model=claude-fable-5.1 copilot=1.0.88

[hivecommons-hive]

Reviewed — no findings from this perspective.

— hive: agent=ci-maintainer backend=copilot model=claude-fable-5.1 copilot=1.0.88

[hivecommons-hive]

Style/conventions review (read at head 91ea763, merge-base dd406b3e9).

1. PR body has no description or issue reference (in-scope, low). The body is only the hive footer, while the change implements issue #14707 almost line-for-line (the new test even cites it: src/pkg/dashboard/contribute_disabled_repo_prefix_test.go:9). Sibling v6 PRs carry Closes #N plus a short What/Why (#14692, #14683), and the review queue reported "no closing issue found" for this PR because the link is absent. Please add to the body:

Closes #14707

Plain `hub.disabled_repos` entries now match the full or bare repo name exactly (case-insensitive) instead of by substring; `*` globs and `/regex/` entries are unchanged. The dashboard toggles (`contribRepoDisabledEntryMatches`, `adminRepoDisabledEntryMatches`) mirror the Go rule and gain `/regex/` support.

2. Advisory (not blocking): RepoMatchesAny detects regex with len(p) > 1 (src/pkg/config/filters.go:26), while WildcardMatch does not (src/crux/config/agent_runtime.go:1325), so a lone / entry is "match everything" for title/label filters but "never matches" for repos. Arguably the safer behaviour, but worth a word in the doc comment since the comment says globs/regex "keep the WildcardMatch semantics".

— hive: agent=reviewer-2 backend=copilot model=claude-fable-5.1 copilot=1.0.88

[hivecommons-hive]

Reviewed — no findings from this perspective.

— hive: agent=reviewer backend=copilot model=claude-fable-5.1 copilot=1.0.88

[hivecommons-hive]

@Karibhou this PR is back in your court (stage/072-returned-to-contributor). The hive will not merge it until the head changes.

Review asks:

• the review swarm requested changes

Reply here or push a new head to this branch (same sign-off); CI and the review swarm re-run automatically and the PR returns to the normal path.

Queued in your relay fix queue (4 waiting): fixes are handed out before new work as soon as you have capacity.

[hivecommons-hive]

@Karibhou the hive has adopted this PR (stage/074-adopted-by-hive): your hive has been offline since the nudge. The hive will rebase this branch on v6 and fix CI here; your commits and sign-off stay. Push a new head yourself at any time and the hive yields it back to you.

[github-actions]

Open PR overlap check

Base branch: v6

Conflicts are checked with every PR merged onto the current tip of v6, so a PR that only needs a rebase is not reported as conflicting with its siblings.

PR	Title	Relation	Files
#14738	✨ retro: show owners review-derived lessons awaiting approval	same files	src/pkg/dashboard/static/index.html

[hivecommons-hive]

Read the diff against v6 @ 9da5696 plus the callers: looks correct to me. One mechanical blocker below.

Verified

• src/pkg/config/filters.go:26-44 RepoMatchesAny: plain entries go to strings.EqualFold against full and bare name; * and /…/ entries still go through WildcardMatch (src/crux/config/agent_runtime.go:1321), so glob/regex/invalid-regex behaviour is unchanged and (?i) keeps regexes case-insensitive. The lone-/ carve-out is a real improvement — WildcardMatch would compile it as an empty regex and match everything.
• All four server call sites that the issue lists (contribute_sse.go:349, contribute_select.go:771, contribute_opportunistic.go:206, api_contribute.go:721) are switched; grep DisabledRepos on the tree finds no other matcher left on substring semantics (defaults.go:158 only normalises, it does not match).
• Both JS copies (static/index.html contribRepoDisabledEntryMatches, contribute_landing.go adminRepoDisabledEntryMatches) implement the same three-way rule with the 'i' flag, and the toggle now refuses to delete regex blockers the same way it refuses wildcards. The node-executed tests pin both copies to the Go cases.
• TestMatchesAnyKeepsSubstringSemantics correctly scopes the change to repos only; title/label/author filters are untouched.

Blocker (not a code defect)

• Head commit 647ae87 ("📝 config: document lone "/" handling…") has no Signed-off-by: trailer; the first two commits do. That is why the dco check is red and the PR carries dco-signoff: no. Re-push that commit with -s (or squash it into 8306504) and the gate clears.

Note for whoever merges: this is a deliberate semantic change — an operator whose disabled_repos relied on substring matching (e.g. a bare bluefin to cover an org) will see those repos become eligible again after upgrade. The changelog fragment says so; just flagging it as a fail-open direction worth a release-note line.

The govulncheck and mobile-shots failures are not from this diff (govulncheck is the golang.org/x/net GO-2026-6860 finding that #14731 bumps).

— hive: agent=reviewer-2 backend=copilot model=claude-fable-5.1 copilot=1.0.88

[hivecommons-hive]

Looks correct to me. Read the tree at v6 (7a506f7), not just the diff.

• The bug mechanism is real: a plain disabled_repos entry reaches strings.Contains(text, pattern) at src/crux/config/agent_runtime.go:1346, so projectbluefin/dakota also matched projectbluefin/dakota-iso. RepoMatchesAny (src/pkg/config/filters.go) replaces that with EqualFold against full and bare names while routing * and /…/ entries back through WildcardMatch, which already compiles regexes with (?i) and returns false on a bad pattern — so the Go and JS semantics line up.
• All four hub-side callers of MatchesAny(repo.Full…) || MatchesAny(repo.Name…) are converted (api_contribute.go:721, contribute_opportunistic.go:206, contribute_select.go:771, contribute_sse.go:349); I found no other Hub.DisabledRepos matcher left behind. NormalizeDisabledReposForRepos (repo_target.go:96) only rewrites bare→full, so it does not reintroduce prefix matching.
• withheldHub (contribute_withheld_test.go:37) seeds projectbluefin/dakota#601/#700, so the new TestReadyQueue_DisabledRepoPrefixDoesNotDisableLongerName fixture is sound; TestGovernorHubReposUseCanonicalDisabledRepoMatching pins the new exact-match line in index.html.

One info-level note on the doc comment (filters.go, the "lone /" paragraph): WildcardMatch would not treat / as an empty regex that matches everything — pattern[1:len(pattern)-1] on a one-byte string is "/"[1:0], which panics at runtime. The behaviour you chose (treat it as a plain entry that never matches) is the right one; only the stated rationale is off.

Red checks: govulncheck is the baseline GO-2026-6860 (golang.org/x/net@v0.61.0, fixed by #14731), not this diff. dco is real: commit 647ae87 ("📝 config: document lone "/" handling…") has no Signed-off-by; the first two commits do. This is a fork branch so the hive cannot push the sign-off — @Karibhou, an amend of that one commit would turn the check green.

— hive: agent=reviewer backend=copilot model=claude-fable-5.1 copilot=1.0.88

[hivecommons-hive]

hive/awaiting-ci: CI pending — sweep will merge when green. Signed off the hive's own follow-up commit in place (647ae87 → 9d8f742, contributor commits untouched); the earlier mobile-shots red was a one-off Chrome profile cleanup race (ENOTEMPTY rmdir .chrome-dashboard-mobile-shots/Default) and re-runs on this push. govulncheck is red on the v6 tip itself.

---

🐝 Hive Agent: scanner | Instance: hosted-available-oke-11-placeholder-r05x | SHA: unknown

— hive: agent=scanner backend=copilot model=claude-fable-5.1 copilot=1.0.88

[hivecommons-hive]

1 of 3 commits on 9d8f74213f6f are the hive's, signed off as the hive App, and the rest are @Karibhou's with their own sign-off. A squash would land the hive's commits under @Karibhou's name with the App's sign-off, so the hive will merge this PR with a merge commit instead (merge-method/merge): every commit lands as it is, each with its own author's sign-off. Nothing is rewritten and nobody needs to act. Maintainers merging by hand: use gh pr merge --merge, not squash.

[hivecommons-hive]

Read against v6 at the head (9d8f742), including the callers and WildcardMatch (crux/config/agent_runtime.go:1321-1357, aliased from pkg/config/crux_aliases.go:182). This looks correct to me.

What I verified:

• RepoMatchesAny (pkg/config/filters.go:26-44) routes * and /…/ entries to WildcardMatch unchanged and only replaces the trailing strings.Contains fall-through (agent_runtime.go:1356) with EqualFold against full and bare name — exactly the fault #14707 names, nothing broader.
• All four server call sites listed in #14707 (api_contribute.go:721, contribute_opportunistic.go:206, contribute_select.go:771, contribute_sse.go:349) are switched; I found no other Hub.DisabledRepos matcher left on the old rule. NormalizeDisabledReposForRepos (repo_target.go:96) already canonicalises plain entries and is unaffected.
• The / guard is a real improvement, not just taste: WildcardMatch slices pattern[1:len(pattern)-1] on a lone /, which panics; RepoMatchesAny never reaches it. (MatchesAny still has that pre-existing edge for title/label filters — out of scope here.)
• Both JS mirrors (index.html contribRepoDisabledEntryMatches, contribute_landing.go adminRepoDisabledEntryMatches) follow the same three-way branch, and the toggle now refuses to delete a regex blocker the same way it refuses a glob — which closes the "turning dakota-iso on strips the dakota entry" hole the tests pin.
• Tests fail without the change (prefix cases on MatchesAny substring semantics); TestMatchesAnyKeepsSubstringSemantics documents that title/label filters are deliberately untouched.

Non-blocking: the red "Sign-off survives the squash" and govulncheck runs look like CI/baseline rather than this diff — the DCO checks are green and no dependencies change here.

— hive: agent=reviewer backend=copilot model=claude-fable-5.1 copilot=1.0.88

[hivecommons-hive]

Read the diff against the v6 tree plus the callers. Looks correct to me.

What I verified:

• src/pkg/config/filters.go:26-41 — RepoMatchesAny routes *//…/ entries through WildcardMatch (src/crux/config/agent_runtime.go:1321), which already lowercases text and compiles regexes with (?i), so glob/regex behaviour is unchanged; plain entries become EqualFold against full and bare name. The lone-/ carve-out (len(p) > 1) is the only divergence from WildcardMatch, and it is the safe direction (a stray / would otherwise be an empty regex matching every repo).
• The two JS mirrors (src/pkg/dashboard/static/index.html:47153-47172, contribute_landing.go:4692-4708) use the same order — regex first, then *, then case-folded equality — and new RegExp(…, 'i') matches the Go (?i); entry.length > 1 mirrors the lone-/ rule.
• All four server call sites named in #14707 (contribute_sse.go:349, contribute_select.go:771, contribute_opportunistic.go:206, api_contribute.go:721) are switched; no other hub.disabled_repos consumer still uses MatchesAny (the remaining MatchesAny callers in contribute_repo_filter.go:124,145 are title/label filters, which TestMatchesAnyKeepsSubstringSemantics pins as intentionally unchanged).
• NormalizeDisabledReposForRepos (repo_target.go:96) already does case-insensitive exact lookup for plain entries, so the write path and the new read path agree.
• TestReadyQueue_DisabledRepoPrefixDoesNotDisableLongerName reuses the withheldHub fixture (contribute_withheld_test.go:40-69, which does carry projectbluefin/dakota#601/#700), so the assertions on withheld keys are grounded.

CI note for the maintainer: the red govulncheck check is also failing on v6 HEAD and this PR changes no dependencies, so it is not attributable to this change.

— hive: agent=reviewer-2 backend=copilot model=claude-fable-5.1 copilot=1.0.88

[hivecommons-hive]

hive/awaiting-ci: rebased onto v6 (bdd285e, x/net v0.62.0 from #14753) to clear the govulncheck GO-2026-6860 finding; no content changes. CI pending — sweep will merge when green.

---

🐝 Hive Agent: scanner | Instance: hosted-available-oke-11-placeholder-r05x | SHA: 3f3b3e786

— hive: agent=scanner backend=copilot model=claude-fable-5.1 copilot=1.0.88

[hivecommons-hive]

Looks correct to me. Read against v6: all four hub.disabled_repos consumers (api_contribute.go:721, contribute_opportunistic.go:206, contribute_select.go:771, contribute_sse.go:349) are switched to config.RepoMatchesAny; git grep 'MatchesAny(.*isabled' on the head leaves none behind. NormalizeDisabledReposForRepos (config/repo_target.go:96) only canonicalises entries and is unaffected.

RepoMatchesAny (config/filters.go) keeps WildcardMatch for * and /…/ entries — WildcardMatch compiles regexes with (?i) and lowercases the text (crux/config/agent_runtime.go:1311), and both JS mirrors use new RegExp(…, 'i'), so Go and the two dashboards agree. The lone-/ divergence is deliberate and tested. The matcher is exercised in Go (repo_matches_test.go), via the hub's withheld-queue path (#14707 repro with dakota / projectbluefin/dakota / mixed case), and by executing the shipped JS under node for both the Settings tab and the admin landing page. No time.Sleep added.

One operator-facing note for whoever merges, not a defect: a plain entry that is a bare owner prefix such as projectbluefin/ used to disable every repo under that owner (substring fallback, agent_runtime.go:1345); it now matches nothing, and the changelog fragment doesn't call that out. If the hosted hive's disabled_repos has such an entry it should become projectbluefin/* on upgrade.

Body matches the diff. PR targets v6 as #14707 requires.

— hive: agent=reviewer-2 backend=copilot model=claude-fable-5.1 copilot=1.0.88

[hivecommons-hive]

Evidence bundle `#14716c057910` sha256:9a192a2cc3ec274e0e9902a9f5dc624b26d442e5f99006247a189f24dd71967a — download from the dashboard or `hivectl review evidence #14716`.

[hivecommons-hive]

Merged by hive contributor-lane auto-merge: CI green for ≥30m, reviewer verdict approve, head c057910bebff adopted by the hive (stage/074-adopted-by-hive) with @Karibhou's commits — merged under the hive's own authority.