Skip to content

chore(codeowners): expand placeholder to real ownership rules #516

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
KooshaPari merged 1 commit into from
Apr 24, 2026
Merged

chore(codeowners): expand placeholder to real ownership rules #516

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
11 changes: 10 additions & 1 deletion .github/CODEOWNERS
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1 +1,10 @@
* @Phenotype-Enterprise/engineering-leads
# Global code owners for KooshaPari org
* @KooshaPari

# Infrastructure as code
/iac/ @KooshaPari
/.github/ @KooshaPari

# Security-sensitive
/SECURITY.md @KooshaPari
/.github/dependabot.yml @KooshaPari

@cursor cursor Bot Apr 24, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

CODEOWNERS references wrong dependabot file extension

Medium Severity

The CODEOWNERS rule targets /.github/dependabot.yml but the actual file in the repository is /.github/dependabot.yaml (.yaml extension). This pattern mismatch means the "Security-sensitive" ownership rule won't apply to the real dependabot config file. Currently masked because the /.github/ rule on line 6 and the global * rule both cover it, but if ownership rules ever diverge, the intended protection for the dependabot config will silently fail.

Fix in Cursor Fix in Web

Reviewed by Cursor Bugbot for commit dbf2f32. Configure here.

Comment on lines +2 to +10

@codeant-ai codeant-ai Bot May 2, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggestion: @KooshaPari appears to be an organization handle, not an individual user or team. CODEOWNERS review requests require assignable owners (users or @org/team), so these entries can be treated as invalid and won't reliably request reviewers. Replace these with valid individual usernames or a team slug (for example @KooshaPari/<team>). [logic error]

Severity Level: Major ⚠️ 
- ⚠️ Global CODEOWNERS rule fails to request intended org owner.
- ⚠️ Security file changes miss desired org-level reviewer coverage.
- ⚠️ Review routing diverges from documented ownership comment intent.
Steps of Reproduction ✅ 
1. With this PR merged, ensure `.github/CODEOWNERS` contains the entries at lines 2–10: `*
@KooshaPari`, `/iac/ @KooshaPari`, `/.github/ @KooshaPari`, `/SECURITY.md @KooshaPari`,
and `/.github/dependabot.yml @KooshaPari`, with the comment at line 1 indicating "Global
code owners for KooshaPari org".

2. Push a branch that changes any file matched by these patterns (for example, modify
`iac/main.tf` or `.github/dependabot.yml`) so that GitHub's CODEOWNERS mechanism is
invoked for the pull request.

3. Create a pull request on GitHub for that branch and observe the automatically requested
reviewers: GitHub evaluates `.github/CODEOWNERS` and attempts to assign owners for the
changed paths.

4. Notice that `@KooshaPari` is never requested as a reviewer on the PR because it is an
organization handle rather than an individual user or `@org/team` slug, so only valid,
assignable owners (such as `@Phenotype-Enterprise/engineering-leads` when the global rule
applies) are requested, contrary to the intended "global owner" behavior described in the
comment.

Fix in Cursor | Fix in VSCode Claude

(Use Cmd/Ctrl + Click for best experience)

Prompt for AI Agent 🤖 
This is a comment left during a code review.

**Path:** .github/CODEOWNERS
**Line:** 2:10
**Comment:**
	*Logic Error: `@KooshaPari` appears to be an organization handle, not an individual user or team. CODEOWNERS review requests require assignable owners (users or `@org/team`), so these entries can be treated as invalid and won't reliably request reviewers. Replace these with valid individual usernames or a team slug (for example `@KooshaPari/<team>`).

Validate the correctness of the flagged issue. If correct, How can I resolve this? If you propose a fix, implement it and please make it concise.
Once fix is implemented, also check other comments on the same PR, and ask user if the user wants to fix the rest of the comments as well. if said yes, then fetch all the comments validate the correctness and implement a minimal fix
👍 | 👎

Loading