[quality] test: cover data/community-roster.json contract (tests/community-roster-data.test.mjs)

[kubestellar-hive]

Test Improvement

Adds tests/community-roster-data.test.mjs — the only file this PR touches.

data/community-roster.json is the declared source of truth for TAB members and CNCF staff (its own _comment says so), and it has no validator. scripts/fetch-community-people.mjs reads roster.sections and roster.fallbackImages and derives every published community profile from them. Its failure modes are all silent — the script exits 0 and writes a degraded data/community-people.json.

The test asserts the invariants the script relies on:

• the file parses; sections and fallbackImages are objects; every section is a non-empty array of plain objects
• name and company are present and non-empty strings on every entry
• role, github, linkedin, twitter are each a non-empty string or explicitly null — never "" or another type
• no entry carries fields outside the six the script destructures, catching a typo'd key (e.g. githubb) that would silently drop a handle
• name values are unique across all sections — fallbackImages is keyed by exact name, so collisions make that lookup ambiguous
• non-null github handles are unique, keeping the existing[section].find(...) previous-run lookup unambiguous, and match GitHub's username grammar
• every entry resolves to an image: it has a github handle or a fallbackImages key exactly matching its name. Without one it publishes image: '' — a headshot-less card
• every fallbackImages key matches some roster name (no dead config), and every value is an absolute https: URL

Verification

node --test tests/community-roster-data.test.mjs: 14 tests pass, 0 fail. Full suite node --test after this change: 69 pass, 0 fail (55 before). npx prettier --check tests/community-roster-data.test.mjs is clean.

All 16 current entries are already well-formed, so this is a regression guard rather than a repair. The guard was mutation-checked — each of these mutations turns the suite red, and reverting it turns it green again:

mutation	caught
duplicate a github handle across two sections	✅
null out the handle of an entry with no fallbackImages key	✅
add a fallbackImages key matching no roster name	✅
set a handle to the invalid bad--handle	✅
typo a field name to githubb	✅
set role to "" instead of null	✅
change a fallbackImages url to http://	✅
pad a name with surrounding whitespace	✅

Coverage evidence

• Unit: node --test --experimental-test-coverage, fresh clone of cncf/endusers at parent revision 00b44df after npm ci, 2026-09-17. Baseline: 55 tests, data/community-roster.json referenced by no test and no validator. After: 69 tests.
• End-to-end: unavailable — this repository has no end-to-end or browser suite and publishes no coverage artifact from any suite (tracked in [quality] CI publishes no coverage evidence, so coverage findings cannot be verified #186). No claim is made that this path lacks end-to-end coverage.

Scope boundary against open PRs

This PR claims tests/community-roster-data.test.mjs and nothing else.

The nearest neighbour is #214, which covers scripts/fetch-community-people.mjs behaviour against synthetic fixtures built inside the test. It never reads the real checked-in data/community-roster.json, so it cannot catch drift in the file that actually ships. The two are complementary and touch no common file. #235 covers data/milestones.json, #208 covers scripts/generate-members.mjs. No package.json, no workflow file, and no shared helper is touched, so it cannot conflict with #225 or #229.

Related Issue

Closes #238

---

Filed by quality agent (hold-gated mode). Human review required.

— hive: agent=quality backend=copilot model=claude-opus-5

[kubestellar-hive]

Important

Held for human review by the hive's ACMM level gate.

This PR was opened by the "quality" agent while Hive policy required a human checkpoint for that agent. Non-outreach agents are held at ACMM L3–L5; the outreach agent is always held because it publishes project-facing communication.

Hive will automatically remove the hold label once current policy no longer requires a level hold for "quality". If this is an outreach PR, a human must review it and remove the label.