From 1edeb8e19d1d451c598774982c10e1dbcad57e3a Mon Sep 17 00:00:00 2001 From: carole-lavillonniere Date: Wed, 2 Sep 2026 10:32:35 +0200 Subject: [PATCH] Add CODEOWNERS so PRs get a reviewer The repo has no CODEOWNERS in any of the three locations GitHub reads, and nothing in dependabot.yml fills in for it (`reviewers` is gone from Dependabot's options reference; we set no `assignees`). So Dependabot PRs open with no reviewer and no assignee -- #100 has been sitting that way -- and every other PR depends on someone noticing it. @localstack/saas matches where secops already routes this image's CVE findings (localstack_products.json, team: SaaS), and the one collaborator with push access who has been reviewing here is in that team. Same single-glob pattern as secops' CODEOWNERS, which is what auto-requests core-systems on its Dependabot PRs (e.g. localstack/secops#110), so this is proven to work for bot PRs in this org. Note it only auto-requests: main has no branch protection or rulesets, so nothing blocks a merge without review. Enforcing that needs a ruleset with "Require review from Code Owners". --- CODEOWNERS | 1 + 1 file changed, 1 insertion(+) create mode 100644 CODEOWNERS diff --git a/CODEOWNERS b/CODEOWNERS new file mode 100644 index 0000000..5c6f187 --- /dev/null +++ b/CODEOWNERS @@ -0,0 +1 @@ +* @localstack/saas