[quality] parseOwners's content-shape arms (owners.ts:39/41/83: whitespace-only, non-mapping and non-string-role OWNERS files) have no bundle test through dist/index.js #405

Finding

The content-shape arms of parseOwners (src/utils/owners.ts:38-90) are reached only by unit tests; no bundle test drives them through dist/index.js:

Evidence (main @ 20d49e7, Node v26.10.0, vitest 5.0.3):

• Unit: npx vitest run --coverage → 100 % lines / 99.82 % branches (124 files / 1994 tests); owners.ts fully covered by __tests__/utils/owners*.test.ts.
• End-to-end: npm run test:coverage:e2e on main → 94.67 % lines / 89.66 % branches of src/; owners.ts branches 124/134 with 39[0], 40[1], 41[1], 41[2] and 83[0] at 0 hits. Re-measured on a scratch branch = origin/main + the heads of all 13 open hold-gated PRs (test(bundle): drive owners-label's early-return and failure arms through dist/index.js #298 … test(bundle): drive blunderbuss's assignee exclusion (pullRequestOwners.ts:96) through dist/index.js #403; 57 files / 416 tests pass, 98.09 % lines): the same five arms stay at 0 hits, so no held PR claims them (test(bundle): drive loadOwnersTree's failure arms (owners.ts L164/L197/L229) through dist/index.js #383 covers loadOwnersTree's L164/L197/L229 failure arms, the already-merged ownersFilters.test.ts covers the filters key).

Why it matters: these are the shapes a user's OWNERS file actually takes when it is being staged or mistyped, and they are the only validation the action performs on OWNERS content. What the shipped bundle does with them — refuse the commenter and say so, or fail the run naming the file and the role, before any authorization probe or write — is pinned nowhere end to end.

Related, filed separately because it needs a production change: a 0-byte OWNERS file never reaches parseOwners at all — decode (owners.ts:163) rejects a blob whose content is "" (#404).

Recommendation

One deliverable: __tests__/bundle/ownersParseArms.test.ts (new file only) driving /approve on a pull request through dist/index.js against fakeGithub with a root OWNERS file of each shape above, asserting exit status, the ::error:: lines, the refusal comment, and that no label write or membership probe happens.

• whitespace-only, yaml-list and yaml-scalar OWNERS → alice is not an approver for any changed file, refusal comment posted, no label write, no membership probe
• approvers/reviewers/labels not a list of strings → error loading OWNERS files at basesha: Error: OWNERS at OWNERS: <role> must be a list of …, no comment, no label write, no membership probe
• leave the 0-byte shape out, naming [quality] a 0-byte OWNERS file fails every OWNERS-reading run with "invalid OWNERS file returned from GitHub API" (decode treats content "" as missing) #404, so the test does not pin the current failure as expected

Priority

• Impact: medium
• Effort: low

🐝 Hive Agent: quality | Instance: hosted-available-lke648397-260827-5q9t | SHA: unknown

— hive: agent=quality backend=copilot model=claude-fable-5.1 copilot=1.0.88