fix(owners): read a 0-byte OWNERS file as listing nobody

__tests__/utils/auth.test.ts

@@ -483,6 +483,7 @@ describe('authorization policies', () => {
       ['a root OWNERS reviewer', { owners: 'reviewers:\n  - alice\n' }, { anyone: true, collaborators: false, members: false, trusted: true }],
       ['a root OWNERS approver', { owners: 'approvers:\n  - alice\n' }, { anyone: true, collaborators: false, members: false, trusted: true }],
       ['nobody in particular', { owners: 'approvers:\n  - bob\n' }, { anyone: true, collaborators: false, members: false, trusted: false }],
+      ['nobody, with a 0-byte root OWNERS file', { owners: '' }, { anyone: true, collaborators: false, members: false, trusted: false }],
       ['nobody, with no root OWNERS file', {}, { anyone: true, collaborators: false, members: false, trusted: false }],
     ] as const)('%s', async (_, who, want) => {
       const fixture: { users?: readonly string[], member?: boolean, collaborator?: boolean, owners?: string } = who

__tests__/utils/ownersAuth.test.ts

@@ -297,6 +297,13 @@ describe('assertAuthorizedByOwnersOrMembership on a pull request', () => {
     )
   })
 
+  it('treats a 0-byte OWNERS file as listing nobody', async () => {
+    server.use(...prHandlers({ OWNERS: '' }, ['src/file1.txt']))
+    await expect(authorize('approvers', 'alice')).rejects.toThrow(
+      'alice is not an approver for any changed file',
+    )
+  })
+
   it('requests the tree recursively and only fetches OWNERS blobs in ancestor directories', async () => {
     const observeTree = new utils.ObserveRequest()
     const observeDocsBlob = new utils.ObserveRequest()

dist/index.js

@@ -41941,7 +41941,7 @@ function isOwnersPath(path) {
 }
 function decode(data, path) {
     const file = data;
-    if (!file.content || !file.encoding) {
+    if (file.content === undefined || !file.encoding) {
         throw new Error(`invalid OWNERS file returned from GitHub API for ${path}`);
     }
     return external_node_buffer_.Buffer.from(file.content, file.encoding).toString();
@@ -42528,7 +42528,7 @@ async function retrieveOwnersFile(octokit, context) {
         }
         throw new Error(`error checking for an OWNERS file at the root of the repository: ${e}`);
     }
-    if (!data.content || !data.encoding) {
+    if (data.content === undefined || !data.encoding) {
         throw new Error(`invalid OWNERS file returned from GitHub API: ${data}`);
     }
     const decoded = external_node_buffer_.Buffer.from(data.content, data.encoding).toString();

src/utils/auth.ts

@@ -191,7 +191,7 @@
  * @param octokit - a hydrated github client
  * @param context - the github actions event context
  * @param issueNum - the issue or pr number this runtime is associated with
  * @param args - the users to check auth on
  */
 export async function checkCommenterAuth(
   octokit: Octokit,
@@ -490,7 +490,7 @@
     )
   }
 
-  if (!data.content || !data.encoding) {
+  if (data.content === undefined || !data.encoding) {
     throw new Error(`invalid OWNERS file returned from GitHub API: ${data}`)
   }
 

src/utils/owners.ts

@@ -160,7 +160,7 @@ function isOwnersPath(path: string): boolean {
 
 function decode(data: unknown, path: string): string {
   const file = data as { content?: string, encoding?: string }
-  if (!file.content || !file.encoding) {
+  if (file.content === undefined || !file.encoding) {
     throw new Error(`invalid OWNERS file returned from GitHub API for ${path}`)
   }
   return Buffer.from(file.content, file.encoding as BufferEncoding).toString()