Bug Report: List Codeowners Errors endpoint does not return errors for branches in private repos.

[TansyArron]

Select Topic Area

Bug

Body

I'm working on a github action to prevent PR's with malformed CODEOWNERS files from being merged. In my initial testing I found that calling the github api endpoint for list codeowners errors returns an empty list of errors even when errors are present.

Repro:

• Create a private repository.
• Create a branch with a malformed code owners file. Note that in the github UI you will see a warning - "This CODEOWNERS file contains errors."
• Create a token with repo access.
• Run

curl -L -H "Accept: application/vnd.github+json" -H "Authorization: Bearer {TOKEN}" -H "X-GitHub-Api-Version: 2022-11-28" https://api.github.com/repos/{ORG}/{REPO}/codeowners/errors?ref={COMMIT SHA WITH MALFORMED CODEOWNERS}"

• The response should contain a list of errors present in your CODEOWNERS, but instead contains only an empty list:

{
  "errors": []
}

Notes:

• The API appears to work fine on public repos.
• Providing a non existent branch or commit will result in a "not found" error.
• Failing to provide a token or providing a token with insufficient permissions will result in a "bad credentials" error.

[brianberzins]

This is particularly dangerous because the codeowners feature is designed to act as a control, and in this case, we have a situation where using the API to check the validity of that control fails silently.

Special thanks to @TansyArron for posting this. I lost an afternoon trying to figure out how on earth I was getting back an empty error message, and could have lost a lot more time if not for this post.