From 8c31ff812812bcf93ce3927897b403146d38f47f Mon Sep 17 00:00:00 2001 From: Mariusz Sabath Date: Fri, 9 Oct 2026 15:23:47 -0400 Subject: [PATCH 1/2] fix: point CODEOWNERS at a team that exists The rule for .github/ named @rossoctl/platform, which does not exist as a team in the org. GitHub silently ignores a rule naming a team that is missing or lacks write access, so this tree had no owner and no warning -- reviews for it fell back to the `*` default. Replaces it with the handles the project's MAINTAINERS.md assigns to this work: Hai owns the Cortex proxy and plugin pipeline architecture and authored 17 of the last 30 commits here, and Gloire owns org-wide CI and repo governance. Both hold admin on this repository, so the rule now resolves. The `*` default and the documentation rules were already pointing at @rossoctl/maintainers, which does exist, and are unchanged. Also records in the header why this file cannot simply defer to rossoctl/rossoctl the way the community-health files do: CODEOWNERS accepts only user and team handles, and is read only from this repository. These names are a copy to resync, not a pointer. Assisted-By: Claude (Anthropic AI) Signed-off-by: Mariusz Sabath --- .github/CODEOWNERS | 19 +++++++++++++++++-- 1 file changed, 17 insertions(+), 2 deletions(-) diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS index aff66dd02..6cf5adf2a 100644 --- a/.github/CODEOWNERS +++ b/.github/CODEOWNERS @@ -1,9 +1,24 @@ +# Code owners for rossoctl/cortex. +# +# Owners here are DERIVED from the project's source of truth for maintainership: +# https://github.com/rossoctl/rossoctl/blob/main/MAINTAINERS.md +# +# CODEOWNERS cannot reference that file, or any file: GitHub accepts only user and team +# handles, and it is read only from this repository's root, .github/ or docs/ -- there is no +# inheritance from rossoctl/rossoctl to lean on. So these names are a copy, and they have to +# be updated when MAINTAINERS.md changes. +# +# A rule naming a user or team that does not exist, or that lacks write access here, is +# silently ignored -- the matched paths end up with no owner and no warning. If you edit this +# file, confirm every handle still has access. + # Default owners for everything. The AuthBridge components used to carry their # own rule for authbridge/; that tree is now the repo root, so `*` covers it. * @rossoctl/maintainers -# CI/CD and GitHub configuration -.github/ @rossoctl/platform +# CI/CD and GitHub configuration. Hai owns the Cortex proxy and plugin pipeline and has +# written most of this tree; Gloire owns org-wide CI and repo governance. +.github/ @huang195 @rubambiza # Documentation *.md @rossoctl/maintainers From 591d38cbbad034eac999e1975765082c3c37d981 Mon Sep 17 00:00:00 2001 From: Mariusz Sabath Date: Fri, 9 Oct 2026 16:31:32 -0400 Subject: [PATCH 2/2] fix: Point the CODEOWNERS header at the API check, drop a commit stat Both from @huang195's review. The header warned about a failure GitHub does not announce loudly and then told the editor to confirm access by hand -- which is the same gap one layer up. It now names the check: `gh api .../codeowners/errors` returns every unknown or write-less handle in the file, so existence, visibility and access are one call rather than a per-handle habit. "Silently" is also too strong; GitHub does flag the line in the file view. The .github/ rationale cited a commit count, which goes stale the first time somebody else lands a few workflow PRs and then needs editing. The roles are the durable part, and the PR body keeps the evidence. Assisted-By: Claude (Anthropic AI) Signed-off-by: Mariusz Sabath --- .github/CODEOWNERS | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS index 6cf5adf2a..076274558 100644 --- a/.github/CODEOWNERS +++ b/.github/CODEOWNERS @@ -9,15 +9,17 @@ # be updated when MAINTAINERS.md changes. # # A rule naming a user or team that does not exist, or that lacks write access here, is -# silently ignored -- the matched paths end up with no owner and no warning. If you edit this -# file, confirm every handle still has access. +# ignored -- the matched paths end up with no owner. GitHub reports this only in the file +# view and via the API; after editing, `gh api repos/rossoctl/cortex/codeowners/errors` +# must return an empty list. That one call checks existence, visibility and write access +# for every handle in this file. # Default owners for everything. The AuthBridge components used to carry their # own rule for authbridge/; that tree is now the repo root, so `*` covers it. * @rossoctl/maintainers -# CI/CD and GitHub configuration. Hai owns the Cortex proxy and plugin pipeline and has -# written most of this tree; Gloire owns org-wide CI and repo governance. +# CI/CD and GitHub configuration, owned per MAINTAINERS.md (Cortex proxy & plugin +# pipeline; org-wide CI & repo governance). .github/ @huang195 @rubambiza # Documentation