Repository navigation
fix: point CODEOWNERS at a team that exists - #1353
Conversation
The rule for .github/ named @rossoctl/platform, which does not exist as a team in the org. GitHub silently ignores a rule naming a team that is missing or lacks write access, so this tree had no owner and no warning -- reviews for it fell back to the `*` default. Replaces it with the handles the project's MAINTAINERS.md assigns to this work: Hai owns the Cortex proxy and plugin pipeline architecture and authored 17 of the last 30 commits here, and Gloire owns org-wide CI and repo governance. Both hold admin on this repository, so the rule now resolves. The `*` default and the documentation rules were already pointing at @rossoctl/maintainers, which does exist, and are unchanged. Also records in the header why this file cannot simply defer to rossoctl/rossoctl the way the community-health files do: CODEOWNERS accepts only user and team handles, and is read only from this repository. These names are a copy to resync, not a pointer. Assisted-By: Claude (Anthropic AI) <noreply@anthropic.com> Signed-off-by: Mariusz Sabath <mrsabath@gmail.com>
|
Warning Review limit reachedYou've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. Next included review available in 56 minutes. View limit detailsLimit details: You’ve used the included review currently available. Review configuration: ⚙️ Run configuration
📒 Files selected for processing (1)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
huang195
left a comment
huang195
left a comment
There was a problem hiding this comment.
Dobra robota, Mariusz. A team that doesn't exist owning .github/ is exactly the kind of bug that lives forever because nothing ever complains. Verified: orgs/rossoctl/teams/platform returns 404, both handles hold admin on cortex, the CODEOWNERS errors API flags line 6 on main and returns nothing on this branch, and the 17-of-30 count checks out (I'm choosing to take it as a compliment).
One correction to the PR description, and it actually makes your case stronger: unowned paths do not fall back to *. The last matching rule wins even when its owner is invalid, so .github/ changes got nobody. #1171, #1095 and this PR (all .github/-only) show no automatic review requests, while each of the six most recent merged PRs auto-requested @rossoctl/maintainers. Your file header already says "no owner", so only the body is off. Low risk overall: main doesn't require code-owner review, so this only changes who gets auto-requested.
FYI, not for this PR: the header says owners are derived from MAINTAINERS.md, but * and *.md delegate to @rossoctl/maintainers, and that team's membership has drifted from the file in both directions. Worth an org-side sync at some point.
Author: mrsabath (MEMBER, maintainer) · Areas: GitHub config (CODEOWNERS) · Agent/IDE config: none · Commits: 1, signed off · CI: green
| # A rule naming a user or team that does not exist, or that lacks write access here, is | ||
| # silently ignored -- the matched paths end up with no owner and no warning. If you edit this | ||
| # file, confirm every handle still has access. |
There was a problem hiding this comment.
Careful, you wrote a header warning editors about a silent failure and then told them to check it by hand 😄 "No warning" isn't quite right either: GitHub highlights the bad line in the file view and exposes it via the API. On main today:
$ gh api repos/rossoctl/cortex/codeowners/errors --jq '.errors[].message'
Unknown owner on line 6: make sure the team @rossoctl/platform exists, is publicly visible, and has write access to the repository
On this branch it returns {"errors":[]}. That one call checks existence, visibility and write access for every handle, so the next editor can't skip a check:
| # A rule naming a user or team that does not exist, or that lacks write access here, is | |
| # silently ignored -- the matched paths end up with no owner and no warning. If you edit this | |
| # file, confirm every handle still has access. | |
| # A rule naming a user or team that does not exist, or that lacks write access here, is | |
| # ignored -- the matched paths end up with no owner. GitHub reports this only in the file | |
| # view and via the API; after editing, `gh api repos/rossoctl/cortex/codeowners/errors` | |
| # must return no errors. |
Optional follow-up: a CI step that fails when that list is non-empty would turn "they have to be updated" from a hope into a gate.
| # CI/CD and GitHub configuration. Hai owns the Cortex proxy and plugin pipeline and has | ||
| # written most of this tree; Gloire owns org-wide CI and repo governance. |
There was a problem hiding this comment.
nit: flattered, but "has written most of this tree" is a stat. It goes stale the first time Alan or you land a few workflow PRs, and then someone has to decide whether to edit a comment about my commit count 🙃 The why is already in the PR body. The file can just name the roles:
| # CI/CD and GitHub configuration. Hai owns the Cortex proxy and plugin pipeline and has | |
| # written most of this tree; Gloire owns org-wide CI and repo governance. | |
| # CI/CD and GitHub configuration, owned per MAINTAINERS.md (Cortex proxy & plugin | |
| # pipeline; org-wide CI & repo governance). |
Both from @huang195's review. The header warned about a failure GitHub does not announce loudly and then told the editor to confirm access by hand -- which is the same gap one layer up. It now names the check: `gh api .../codeowners/errors` returns every unknown or write-less handle in the file, so existence, visibility and access are one call rather than a per-handle habit. "Silently" is also too strong; GitHub does flag the line in the file view. The .github/ rationale cited a commit count, which goes stale the first time somebody else lands a few workflow PRs and then needs editing. The roles are the durable part, and the PR body keeps the evidence. Assisted-By: Claude (Anthropic AI) <noreply@anthropic.com> Signed-off-by: Mariusz Sabath <mrsabath@gmail.com>
Summary
The rule for
.github/named@rossoctl/platform, which does not exist as a team in the org:GitHub silently ignores a CODEOWNERS rule naming a team that is missing or that lacks write access. There is no warning — the matched paths simply have no owner, and review requests fall back to the
*default.The fix
Owners now come from the project's source of truth for maintainership,
rossoctl/rossoctl/MAINTAINERS.md, matched to who actually works on this tree:.github/@huang195 @rubambizaBoth hold
adminon this repository, so the rule resolves — verified per handle, not assumed.The
*default and the documentation rules already pointed at@rossoctl/maintainers, which does exist, and are unchanged.Why this file cannot point at MAINTAINERS.md
Unlike the community-health files —
SECURITY.md,CODE_OF_CONDUCT.md,CONTRIBUTING.md,SUPPORT.md, which GitHub genuinely does inherit from the org.githubrepo — CODEOWNERS has no inheritance and accepts no file references. It takes only user and team handles, and is read only from this repository's root,.github/, ordocs/.So these names are a copy that must be resynced when MAINTAINERS.md changes. The header records that, and tells an editor to re-confirm access — the exact failure mode this PR repairs.
Related
Same fix applied across the org: rossoctl/moca#480 and the companion PR on
rossoctl/examples.