test: cover data/community-people.json contract (tests/community-people-data.test.mjs)

[kubestellar-hive]

Test Improvement

data/community-people.json was the only generated data file in the repository with neither a validator script nor a test. It is regenerated on a schedule by .github/workflows/refresh-community-people.yml and read directly by src/components/CommunityPeople/index.js, which docs/community/end-user-community.md renders as section="tab" and section="staff". Because the component does peopleData.people[section] || [], a refresh that renames, drops or empties a section produces an empty grid with no build error — the Community page silently loses its people.

Files claimed by this PR (test-only; one new file, nothing else touched):

• tests/community-people-data.test.mjs (new) — 14 tests asserting the committed data/community-people.json against exactly the contract its consumers rely on:
  • fetchedAt is a parseable date and people is a plain object of arrays
  • the section keys equal the section keys of data/community-roster.json, and each section has one generated entry per rostered person — the generator's own invariant
  • every section="..." the docs actually render exists and is non-empty. The section names are discovered by scanning docs/**/*.md(x) for <CommunityPeople section="…"> rather than hard-coded, so a newly rendered section is covered automatically; a guard test fails if that scan ever finds nothing.
  • per person: name non-empty and unique within its section (the component keys cards by name), image a non-empty https:// URL, bio/location/blog strings, role/linkedin/twitter/profileUpdatedAt string-or-null, publicRepos/followers non-negative integers, profileUpdatedAt parseable when present
  • github/linkedin/twitter are bare handles. The component interpolates them unescaped into https://github.com/${value}, https://www.linkedin.com/in/${value} and https://twitter.com/${value}, so a value containing /, ?, # or .. would send the link somewhere other than the profile it claims.
  • blog is empty or normalises to an http/https URL with a host, applying the component's own startsWith('http') ? blog : 'https://' + blog rule

No production code, no new dependency, and no workflow file is touched — npm run test:unit (node --test) already discovers tests/*.test.mjs and CI already runs it.

Verification

Local clone of cncf/endusers at parent revision 00b44df after npm ci, 2026-09-17:

• node --test: 69 tests pass, 0 fail (55 before).
• npx prettier --check tests/community-people-data.test.mjs is clean.
• Mutation-checked against the real file, restoring it after each run — renaming tab to tab2 fails 3 tests, emptying staff fails 2, setting a github handle to evil.com/x fails 1, and blanking an image fails 1. The suite is not vacuous.

Coverage evidence

• Unit: node --test --experimental-test-coverage at 00b44df — before this PR, 55 tests pass and the coverage report lists only scripts/** and tests/helpers.mjs; no test loaded data/community-people.json.
• End-to-end: the repository defines no end-to-end or browser suite — no playwright/cypress/puppeteer/selenium dependency or script in package.json and no such job in any of the six workflows in .github/workflows/. It also publishes no coverage artifact from any suite (tracked in [quality] CI publishes no coverage evidence, so coverage findings cannot be verified #186), so no cross-suite coverage merge was possible.

Scope, against the open quality PRs

This PR claims tests/community-people-data.test.mjs and no other file. It is disjoint from #214, which covers scripts/fetch-community-people.mjs behaviour with an offline fetch stub rather than the committed output, and from #241, the data/community-roster.json contract — this suite reads the roster only to compare section keys and person counts and asserts nothing about the roster's own internal shape. It adds no dependency and does not touch package.json, so it does not overlap #225 or #229.

Related Issue

Closes #256

---

Filed by quality agent (hold-gated mode). Human review required.

— hive: agent=quality backend=copilot model=claude-opus-5

[kubestellar-hive]

Important

Held for human review by the hive's ACMM level gate.

This PR was opened by the "quality" agent while Hive policy required a human checkpoint for that agent. Non-outreach agents are held at ACMM L3–L5; the outreach agent is always held because it publishes project-facing communication.

Hive will automatically remove the hold label once current policy no longer requires a level hold for "quality". If this is an outreach PR, a human must review it and remove the label.