From 271550c264e224fd27a3673985411f5b7bf6d78f Mon Sep 17 00:00:00 2001 From: Patrice Chalin Date: Sat, 19 Sep 2026 10:19:56 -0400 Subject: [PATCH] Add CODEOWNERS and document the code-owner merge gate - Names the `docsy/maintainers` team as code owner for every path, so the `main` ruleset's code-owner review requirement makes team membership the review boundary (a workflow's approval never counts). - States the merge rules in the maintainer notes; the code-scanning rule is now live, so "comes from". --- .github/CODEOWNERS | 4 ++++ CONTRIBUTING.md | 11 ++++++++++- 2 files changed, 14 insertions(+), 1 deletion(-) create mode 100644 .github/CODEOWNERS diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS new file mode 100644 index 0000000000..4725a853f7 --- /dev/null +++ b/.github/CODEOWNERS @@ -0,0 +1,4 @@ +# The `main` ruleset requires a code-owner review, so this team's membership is +# the review boundary. The team needs an explicit repo grant (Maintain) or +# GitHub silently ignores it here. +* @docsy/maintainers diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index 5e7ea36d0e..05301e381d 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -122,7 +122,7 @@ against already-pinned actions. Results upload to the repository's Security tab as code-scanning alerts. - The job passes whatever it finds; findings are alerts to triage. Blocking, if - any, would come from a code-scanning rule in a ruleset on `main`. + any, comes from a code-scanning rule in a ruleset on `main`. - The workflow calls the [OpenTelemetry shared workflow][otel-zizmor] at a pinned commit; that workflow pins the zizmor action, which pins the zizmor image by digest, so the scanner moves only when the pin here does. Review the @@ -138,6 +138,15 @@ as code-scanning alerts. - `security-events: write` sits alone in this workflow, away from the job that installs and builds. +### Merging to `main` + +The `main` branch ruleset requires one approving review from a code owner: +`.github/CODEOWNERS` names the `@docsy/maintainers` team for every path, so team +membership is the review boundary, and a workflow's approval never satisfies the +rule. The team holds an explicit Maintain grant on the repo; without one GitHub +silently ignores a CODEOWNERS team. The Maintain role and above can bypass the +review rule (**Bypass rules and merge**, or `gh pr merge --admin`). + [alternate dashboard]: https://app.netlify.com/sites/goldydocs/deploys [deploys]: https://app.netlify.com/sites/docsy-example/deploys [Docsy]: https://github.com/google/docsy