fix: allowlist checks

[gusfcarvalho]

No description provided.

[Copilot]

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.

[Copilot]

Pull request overview

Copilot reviewed 7 out of 7 changed files in this pull request and generated 2 comments.

[Copilot]

Pull request overview

Copilot reviewed 7 out of 7 changed files in this pull request and generated 3 comments.

Comments suppressed due to low confidence (1)

internal/data.go:132

• Admin member collection has the same “missing evidence vs empty list” ambiguity as teams: allAdminMembers is initialized to an empty slice, and on API error the code breaks and returns members: []. This makes it impossible for policies to distinguish “no admin members” from “failed to fetch admin members”, which can lead to incorrect evaluations when collection fails. Consider returning a nil slice on collection failure (or representing collection status explicitly).

	allAdminMembers := make([]*github.User, 0)
	memberOpt := &github.ListMembersOptions{
		Role:        "admin",
		ListOptions: github.ListOptions{PerPage: 100},
	}

	for {
		members, resp, err := df.client.Organizations.ListMembers(ctx, organization, memberOpt)
		if err != nil {
			df.logger.Warn("Skipping admin member collection after GitHub API error", "org", organization, "error", err)
			accumulatedErrors = errors.Join(accumulatedErrors, fmt.Errorf("failed to fetch admin members: %w", err))
			break
		}

		allAdminMembers = append(allAdminMembers, members...)
		if resp.NextPage == 0 {
			break
		}
		memberOpt.Page = resp.NextPage
	}