Add CODEOWNERS for reviewer routing - #426
Merged
Merged
Conversation
Routes review requests for path categories explicitly: - Default (*) — @melvincarvalho - Auth / security paths (src/auth, src/idp, src/utils/ssrf.js) — @melvincarvalho explicitly, signalling security-sensitive surface - CLI / release surface (bin/, package.json, package-lock.json) — @melvincarvalho explicitly, since these affect what npm publishes - Legal / policy substrate (LICENSE, CONTRIBUTING.md, .github/) — @melvincarvalho explicitly Currently all paths route to the same maintainer; the per-path breakdown documents review responsibility intent for paths that should always get explicit maintainer review when contribution volume grows or co-maintainers are added. No enforcement: this just causes GitHub to auto-request review from listed owners on PRs touching matching paths. Without a branch-protection rule requiring CODEOWNERS approval the request is advisory.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds
.github/CODEOWNERSto route GitHub's auto-review-request mechanism for paths that should always get explicit maintainer review.Categories
*) — all files/src/auth/,/src/idp/,/src/utils/ssrf.js/bin/,/package.json,/package-lock.json/LICENSE,/CONTRIBUTING.md,/.github/All currently route to
@melvincarvalho. The per-path breakdown documents review-responsibility intent rather than splitting reviewers — the structure is ready for co-maintainer expansion when J O'Hare onboards (security/release paths stay with the lead, broader code can split).Behaviour
CODEOWNERS by itself is advisory — it causes GitHub to auto-request review from the listed owners on PRs touching matching paths. Without a branch-protection rule requiring CODEOWNERS approval, it doesn't block merges. That's intentional for now; this PR is the path-mapping side of the work, and protection-rule enforcement can follow later when there's a second maintainer to enforce against.