Merge pull request #518 from alphagov/update-codeowners-file

Author: querkmachine

.github/dependabot.yml

@@ -1,7 +1,6 @@
 version: 2
 
 updates:
-
   # Update npm packages
   - package-ecosystem: npm
     directory: /
@@ -12,10 +11,8 @@ updates:
       # First in list so Dependabot looks at updating those first
       design-system:
         patterns:
-          - 'govuk-frontend'
-          - 'accessible-autocomplete'
-    reviewers:
-      - alphagov/design-system-developers
+          - "govuk-frontend"
+          - "accessible-autocomplete"
     schedule:
       # Defaults to weekly on Monday
       interval: monthly
@@ -30,8 +27,6 @@ updates:
   # Update Ruby gems
   - package-ecosystem: bundler
     directory: /
-    reviewers:
-      - alphagov/design-system-developers
     schedule:
       # Defaults to weekly on Monday
       interval: monthly
@@ -46,8 +41,6 @@ updates:
   # Update GitHub Actions
   - package-ecosystem: github-actions
     directory: /
-    reviewers:
-      - alphagov/design-system-developers
     schedule:
       # Defaults to weekly on Monday
       interval: monthly

CODEOWNERS

@@ -1,2 +1,12 @@
 # CI/CD (which has access to secrets and to production)
 .github/workflows/  @alphagov/design-system-developers
+
+# Track changes to package.json or package-lock.json
+/package*.json  @alphagov/design-system-developers
+
+# Track changes to Gemfiles
+/Gemfile  @alphagov/design-system-developers
+/Gemfile.lock  @alphagov/design-system-developers
+
+# Protect the CODEOWNERS file itself against malicious changes
+CODEOWNERS  @alphagov/design-system-developers