Migrate OWNERS-file dispatch authorization from bash/yq to a Go implementation

[ralphbean]

What happens

PR #6051 (closing #6042) added opt-in Prow OWNERS-file authorization to has_repo_permission() in .github/workflows/reusable-dispatch.yml. The logic is implemented entirely as inline bash and yq calls embedded in the workflow YAML:

• Authorization decisions for OWNERS approvers/reviewers happen via string-interpolated yq queries inside a shell function.
• Errors (malformed YAML, missing files, yq failures) silently fall through to the GitHub collaborator-API fallback, with no structured error handling.
• The logic can't be unit-tested outside a live GitHub Actions run — it's only exercised end-to-end via godog e2e scenarios that parse real workflow logs.
• authorization.owners_file is read directly from .fullsend/config.yaml via yq, bypassing the existing internal/config.LoadConfig overlay → base → code-defaults merge chain. Setting authorization.owners_file: true in a shared .fullsend/config.base.yaml preset has no effect — it only works when set in each repo's overlay config.yaml directly.

What should happen

The OWNERS-file (and, more broadly, any future non-GitHub-native) authorization logic should live in a Go package with proper types, error handling, and unit test coverage, invoked by the workflow through a CLI subcommand rather than reimplemented in bash. Whatever replaces the current bash implementation should read config through the existing internal/config.LoadConfig merge chain, so authorization.owners_file (and any future authorization config) correctly honors config.base.yaml presets.

Context

• Original design discussion: Support Prow/OWNERS file permission model for slash command authorization #6042
• Introduced as an explicit, acknowledged stopgap in feat(#6042): support Prow OWNERS file authorization for slash commands #6051 — the PR author flagged the bash/yq approach as technical debt but didn't attempt a Go migration due to scope/confidence concerns around the CLI build/cache pipeline as a first-time contributor.
• @ralphbean proposed the long-term direction on feat(#6042): support Prow OWNERS file authorization for slash commands #6051: a new fullsend authz check-permission (or similar) CLI subcommand the workflow calls instead of inline bash, noting the design needs to account for authorization checks against a NormalizedEvent that could originate from Jira as well as GitHub.
• The config.base.yaml gap was found during review of feat(#6042): support Prow OWNERS file authorization for slash commands #6051 and folded in here since it's a direct consequence of the same bash/yq-reads-the-file-directly architecture.

[fullsend-ai-triage]

🤖 Finished Triage · ✅ Success · Started 8:18 PM UTC · Completed 8:23 PM UTC

Commit: 1cf646e · View workflow run →

[fullsend-ai-triage]

⚠ Workflow changes required — the full resolution involves modifying .github/workflows/reusable-dispatch.yml to replace inline bash/yq with a CLI subcommand call. The code agent cannot modify workflow files under current permissions, so the workflow integration step will require a manual PR or maintainer action. The Go package and CLI subcommand can be implemented independently.

Proposed test case

// internal/authz/owners_test.go

func TestOwnersFileAuthorization(t *testing.T) {
    ownersYAML := `approvers:\n  - alice\nreviewers:\n  - bob`
    checker := authz.NewOwnersChecker(parseOWNERS(ownersYAML))
    assert.True(t, checker.HasPermission("alice"))
    assert.True(t, checker.HasPermission("bob"))
    assert.False(t, checker.HasPermission("eve"))
}

func TestOwnersFileMalformedYAML(t *testing.T) {
    _, err := authz.ParseOwnersFile([]byte("not: [valid: yaml"))
    assert.Error(t, err)
}

func TestOwnersConfigMergeChain(t *testing.T) {
    baseCfg := `authorization:\n  owners_file: true`
    cfg := config.LoadConfig("", baseCfg)
    assert.True(t, cfg.Authorization.OwnersFile)
}

Related work

• PR feat(#6042): support Prow OWNERS file authorization for slash commands #6051 implements the current bash/yq stopgap. It is still open — the Go migration may supersede or build on top of it. Coordinate to avoid conflicting approaches.
• Issue Support Prow/OWNERS file permission model for slash command authorization #6042 is the original OWNERS-file feature design discussion.

---

Labels: This is a feature-category issue involving refactoring bash into Go (tech-debt) in the dispatch component. Priority/medium matches the original feature issue (#6042) severity and the non-urgent nature of the migration.

---

Next steps:

• /fs-code — agent creates a PR to implement this issue
• /fs-code <your instruction> — agent implements with your specific guidance

[RaphaelBut]

Adding a note to this comment here, in case we move the authentication provider list to this issue #6051 (comment)

[RaphaelBut]

Please note the current prow/owners auth is minimally implemented and only handles approvers, reviewers, and aliases.
Prow supports emeritus_approvers, filters, labels, and nested OWNERS in subdirectories...

Fail-closed (unsupported features return None), but users of these features get silent no-ops.