repo-fleet-hygiene: bare-repo-with-working-tree ships on main with zero test coverage after a stale-base squash and its fix

[kyle-sexton]

Problem

bare-repo-with-working-tree is shipping on main with zero test coverage. The feature works; nothing defends it.

symbol	occurrences in audit-fleet.sh	occurrences in audit-fleet.test.sh
bare-repo-with-working-tree	2	0
BARE_LIVE_TREE	19	0
directory_has_non_git_entries	3	0

This is the residue of a two-step accident, and the second step is the one worth understanding, because a branch-protection rule would not have caught it.

Evidence

Step 1 — #2633 was a stale-base squash that silently reverted two merged features.

cc58cbc5 (#2633) has a single parent bfb66beb (the #2644 merge). Counting occurrences in plugins/repo-fleet-hygiene/scripts/audit-fleet.sh:

tree	graphql	rollup
bfb66beb — #2633's parent	24	9
cc58cbc5 — #2633 itself	0	0

A commit whose parent contains a feature and whose own tree lacks it reverted that feature. Not a dropped call or a shadowed variable — a whole-file stale-base revert: audit-fleet.sh 1108 lines changed, audit-fleet.test.sh 578, net −616 across the plugin. The branch was cut before #2642 landed and squashed without rebasing, so its diff reinstated the pre-#2642 file wholesale plus the bare-repo fix.

Step 2 — #2640 fixed the revert but dropped the tests, and it was not stale-based.

6f0a3110's parent is cc58cbc5, i.e. then-current main. It was a hand-composed test file built from the #2644 lineage that failed to carry #2633's tests across. git diff d213ef71^ d213ef71 -- .../audit-fleet.test.sh removes 51 bare-referencing lines: the bare-live / bare-pure / bare-live-link fixtures (:25-35), the worktree-list cases (:285-296), and the end-to-end assertion block (:871-895). bare-repo-with-working-tree went 6 → 0.

The two failure modes are distinct. A require-branch-up-to-date rule would have stopped #2633. It would not have stopped #2640. Same symptom, different cause — worth stating explicitly so the fix is not assumed to be a settings change alone. (Settings for this org are Pulumi-managed in melodic-software/github-iac, so any protection-rule change belongs there, not here.)

Why CI passed both times. ci-status and plugin-gate were green on #2633 (6m17s) and #2640 (6m27s). CI structurally cannot catch this: a stale-base squash rewrites the test file alongside the source file, so the suite stays self-consistent with whatever it happens to contain. Green means "the tests present agree with the source present" — never "no feature was lost." No test living inside audit-fleet.test.sh can defend against its own deletion.

What was NOT affected, recorded so severity stays honest. The regressed window (00:55:27Z → 01:23:38Z, 28m11s) did not produce a silent false-clean. Regressed main fell back to the pre-#2642 REST path, which self-discloses: cc58cbc5 audit-fleet.sh:1425 emits UNKNOWN github-pr-evidence-unavailable and :1420 carries the window-truncation disclosure. Merge evidence was narrower, not silent. The only thing that vanished without comment was the rollup section, whose absence is a visibly missing report section. No operator's past output misled them into deleting a branch.

Proposed change

1. Restore the bare-repo test block into plugins/repo-fleet-hygiene/scripts/audit-fleet.test.sh — recoverable verbatim from d213ef71^: the three fixtures, the worktree-list cases, and the end-to-end assertion that a bare repository with a live working tree yields MEDIUM bare-repo-with-working-tree carrying the core.bare false remedy, and that a bare-only run does not abort (the :1011 no-targets guard).
2. Add a coverage floor that survives its own deletion. The gap here is that the only defender lived in the file that got rewritten. A check outside that file — asserting every emitted finding kind in audit-fleet.sh has at least one occurrence in the test file — would have failed both fix(repo-fleet-hygiene): report bare repos with live working trees #2633 and fix(repo-fleet-hygiene): restore GraphQL merge evidence and rollups after #2633 #2640. This is the load-bearing half of the fix; item 1 alone restores the symptom's cure, not its cause.

Acceptance criteria

• bare-repo-with-working-tree, BARE_LIVE_TREE, and directory_has_non_git_entries each have non-zero occurrences in audit-fleet.test.sh.
• A test asserts a bare-only run does not abort and emits the finding with its remedy.
• A gate outside audit-fleet.test.sh fails when a finding kind emitted by the script has no test reference, and that gate is proven by running it against cc58cbc5 and 6f0a3110 — it must go red on both.

Method caveat

audit-fleet.test.sh exceeded 550s under Git Bash on Windows and could not be run to completion locally, so the claims above rest on static end-to-end tracing plus GitHub's own plugin-gate results rather than a local green run. The suite's Windows runtime may itself be worth an issue.