Repository: kubernetes-sigs/prow

Issue:
verify-owners: invalid OWNERS_ALIASES should attach the invalid owners label
I was investigating why the approve plugin was not working on a PR, cause being a corrupt OWNERS_ALIASES file. Then I tried to reconstruct the issue and saw that in case of triggering the `/verify-owners` on a corrupt file no reaction is put out to the user, only the issue can be seen in the hook logs.

```
{"author":"dhiller","component":"hook","error":"error parsing aliases config for OWNERS_ALIASES file: unexpected type for alias group member: \u003cnil\u003e","event-GUID":"a0bb4950-8fb0-11f0-8424-3a4711508e48","event-type":"issue_comment","file":"sigs.k8s.io/prow/pkg/hook/events.go:372","func":"sigs.k8s.io/prow/pkg/hook.(*Server).handleGenericComment.func1","level":"error","msg":"Error handling GenericCommentEvent.","org":"kubevirt","plugin":"verify-owners","pr":625,"repo":"hostpath-provisioner-operator","severity":"error","time":"2025-09-12T08:15:29Z","url":"https://github.com/kubevirt/hostpath-provisioner-operator/pull/625#is
suecomment-3284242083"}                                                                                                                                                                                             
```

I believe this should be reported to the user since otherwise the risk of a corrupt file being merged is there.

WDYT?

Hints from issue comments:
@dhiller: /type bug
/area plugins

Solution patch:
diff --git a/pkg/plugins/verify-owners/verify-owners.go b/pkg/plugins/verify-owners/verify-owners.go
index 61883de0c..46bf02d6d 100644
--- a/pkg/plugins/verify-owners/verify-owners.go
+++ b/pkg/plugins/verify-owners/verify-owners.go
@@ -273,7 +273,17 @@ func handle(ghc githubClient, gc git.ClientFactory, roc repoownersClient, log *l
 	// If the file was modified, check for non trusted users in the newly added owners.
 	nonTrustedUsers, trustedUsers, repoAliases, err := nonTrustedUsersInOwnersAliases(ghc, log, triggerConfig, org, repo, r.Directory(), modifiedOwnerAliasesFile.Patch, ownerAliasesModified, skipTrustedUserCheck, filenames)
 	if err != nil {
-		return err
+		// if OWNERS_ALIASES file exists and is not parseable
+		// attach invalid owners label and add message to PR
+		if !hasInvalidOwnersLabel {
+			if err := ghc.AddLabel(org, repo, number, labels.InvalidOwners); err != nil {
+				return err
+			}
+		}
+		if err := ghc.CreateComment(org, repo, number, "The content of OWNERS_ALIASES is invalid."); err != nil {
+			return err
+		}
+		return nil
 	}
 
 	// Check if OWNERS_ALIASES has empty aliases, then add a warning comment



Test patch:
diff --git a/pkg/plugins/verify-owners/verify-owners_test.go b/pkg/plugins/verify-owners/verify-owners_test.go
index 54b06cf6e..ad4a2b019 100644
--- a/pkg/plugins/verify-owners/verify-owners_test.go
+++ b/pkg/plugins/verify-owners/verify-owners_test.go
@@ -145,6 +145,12 @@ var ownerAliasesFiles = map[string][]byte{
 	"toBeAddedAlias": []byte(`aliases:
   not-yet-existing-alias:
   - bob
+`),
+	"invalidOwnersAliases": []byte(`aliases:
+  approvers:
+  - alice
+  - bob
+  -
 `),
 }
 
@@ -451,6 +457,12 @@ func testHandle(clients localgit.Clients, t *testing.T) {
 			addedContent:        "toBeAddedAlias",
 			shouldLabel:         false,
 		},
+		{
+			name:         "invalid OWNERS_ALIASES",
+			filesChanged: []string{"OWNERS_ALIASES"},
+			ownersFile:   "invalidOwnersAliases",
+			shouldLabel:  true,
+		},
 	}
 	lg, c, err := clients()
 	if err != nil {