fix: return real defaults when codeowners.toml fails to parse

internal/config/config.go

@@ -103,12 +103,10 @@ func (r *ApprovalRetention) defaultOff(flag *bool) bool {
 	return r.Enabled && flag != nil && *flag
 }
 
-func ReadConfig(path string, fileReader codeowners.FileReader) (*Config, error) {
-	if !strings.HasSuffix(path, "/") {
-		path += "/"
-	}
-
-	defaultConfig := &Config{
+// Rebuilt per call: toml.Unmarshal merges into the pointer fields already there,
+// so a shared instance would hand partially parsed values back to error paths.
+func newDefaultConfig() *Config {
+	return &Config{
 		MaxReviews:                  nil,
 		MinReviews:                  nil,
 		UnskippableReviewers:        []string{},
@@ -123,6 +121,12 @@ func ReadConfig(path string, fileReader codeowners.FileReader) (*Config, error)
 		RequireBothBranchReviewers:  false,
 		DisableReviewStatusComments: false,
 	}
+}
+
+func ReadConfig(path string, fileReader codeowners.FileReader) (*Config, error) {
+	if !strings.HasSuffix(path, "/") {
+		path += "/"
+	}
 
 	// Use filesystem reader if none provided
 	if fileReader == nil {
@@ -132,25 +136,15 @@ func ReadConfig(path string, fileReader codeowners.FileReader) (*Config, error)
 	fileName := path + "codeowners.toml"
 
 	if !fileReader.PathExists(fileName) {
-		return defaultConfig, nil
+		return newDefaultConfig(), nil
 	}
 	file, err := fileReader.ReadFile(fileName)
 	if err != nil {
-		return defaultConfig, err
-	}
-	config := defaultConfig
-	err = toml.Unmarshal(file, &config)
-	if err != nil {
-		return defaultConfig, err
-	}
-	if config.Enforcement == nil {
-		config.Enforcement = defaultConfig.Enforcement
-	}
-	if config.AdminBypass == nil {
-		config.AdminBypass = defaultConfig.AdminBypass
+		return newDefaultConfig(), err
 	}
-	if config.ApprovalRetention == nil {
-		config.ApprovalRetention = defaultConfig.ApprovalRetention
+	config := newDefaultConfig()
+	if err := toml.Unmarshal(file, config); err != nil {
+		return newDefaultConfig(), err
 	}
 	return config, nil
 }

internal/config/config_test.go

@@ -250,6 +250,45 @@ func TestReadConfigFileError(t *testing.T) {
 	}
 }
 
+// Callers read the config as a security boundary and only warn on error, so a
+// half-parsed file leaking through would let a malformed config relax enforcement.
+func TestReadConfigInvalidTomlReturnsDefaults(t *testing.T) {
+	testDir := t.TempDir()
+	content := `
+[enforcement]
+approval = true
+fail_check = false
+[approval_retention]
+enabled = true
+max_reviews = invalid
+`
+	err := os.WriteFile(filepath.Join(testDir, "codeowners.toml"), []byte(content), 0644)
+	if err != nil {
+		t.Fatalf("failed to write test config: %v", err)
+	}
+
+	config, err := ReadConfig(testDir, nil)
+	if err == nil {
+		t.Fatal("expected a parse error")
+	}
+	if config == nil {
+		t.Fatal("expected a config alongside the error")
+	}
+
+	if config.Enforcement == nil {
+		t.Fatal("expected Enforcement to be set")
+	}
+	if config.Enforcement.Approval || !config.Enforcement.FailCheck {
+		t.Errorf("Enforcement: expected default {Approval:false FailCheck:true}, got %+v", *config.Enforcement)
+	}
+	if config.ApprovalRetention == nil {
+		t.Fatal("expected ApprovalRetention to be set")
+	}
+	if config.ApprovalRetention.Enabled {
+		t.Error("ApprovalRetention.Enabled: expected default false")
+	}
+}
+
 func TestApprovalRetention(t *testing.T) {
 	type resolved struct {
 		whitespace            bool