[quality] auth.ts: the issue-side OWNERS fallback and the membership probes' 500 arms are never driven through dist/index.js #330

Finding

src/utils/auth.ts is 100 % line-covered by the unit run, but the bundle (end-to-end) suite never drives assertAuthorizedByOwnersOrMembership on an issue (as opposed to a pull request), so the whole issue-side arm of OWNERS authorization is unmeasured against the shipped bundle.

Evidence on main @ 3fc21f2 (Node v26.10.0, vitest 5.0.3, @vitest/coverage-v8 5.0.1):

• Unit: npx vitest run --coverage → auth.ts 100 % stmts / 98.43 % branch / 100 % funcs / 100 % lines (only branch 257 residual).
• End-to-end: npm run test:coverage:e2e (5 files / 142 tests) → auth.ts 62.85 % stmts / 53.12 % branch / 78.57 % funcs / 63.1 % lines. Zero hits on:
  • auth.ts:257 — the assertRootOwner call site (the issue?.pull_request === undefined arm). The only bundle test that sends /lgtm on an issue is refused as the author before authorization runs.
  • auth.ts:277-288 assertRootOwner and auth.ts:338-364 retrieveOwnersFile — entirely unexecuted, including the 404 → '' fallback (349-350), the non-404 rethrow (353) and the "invalid OWNERS file returned from GitHub API" guard (358-359).
  • auth.ts:61,64 — checkOrgMember's unexpected-error core.warning arm.
  • auth.ts:135-139 — checkIssueComments's unexpected-error core.warning arm.

Of these, the "root OWNERS file present" arms (277-288, 362-364) and the PR-side no OWNERS file covers arm (321-322) are already claimed by the held #283, and checkCollaborator's 500 arm (98, 101) by the held #306. The arms listed below are not covered by any open PR.

Recommendation

One bundle suite, __tests__/bundle/rootOwnersFallback.test.ts, driving dist/index.js against the fake GitHub:

• /lgtm on an issue by a non-author, root OWNERS read 404, org-membership read 500, collaborator read 204 → ::warning::encountered unexpected error: status=500, message=boom, lgtm applied (auth.ts:257, 349-350, 61, 64)
• same, org and collaborator reads both 404 → refused with Codertocat is not a org member or collaborator, exit 1, no label write (auth.ts:262 on the issue arm)
• root OWNERS read 500 → refused with error checking for an OWNERS file at the root of the repository: HttpError: boom, no membership read (auth.ts:353)
• root OWNERS is a directory (contents API returns a listing without content) → refused with invalid OWNERS file returned from GitHub API, no membership read (auth.ts:358-359)
• /unassign by a non-member whose issue-comments read returns 500 → ::warning::encountered unexpected error checking issue comments: status=500, message=boom, no assignee removal (auth.ts:135-139)

Expected result: auth.ts e2e lines 63.1 % → ~81.5 %; the remainder is #283/#306 ground plus the getErrorDetails non-object arm (22) and the four catch rethrows in getOrgCollabCommentUsers/checkCommenterAuth (179, 208, 215, 222), which cannot fire because the functions they wrap never throw.

Priority

• Impact: medium — covered by unit tests, not by the end-to-end suite
• Effort: low

Filed by quality agent (hold-gated mode)

🐝 Hive Agent: quality | Instance: hosted-available-lke648397-260827-5q9t | SHA: 3fc21f2

— hive: agent=quality backend=copilot model=claude-fable-5.1