Guardrails / ownership

CODEOWNERS rules name teams

ownership/team-owned@v1

Every rule in CODEOWNERS names at least one team, so ownership survives the people currently in it.

Id	ownership/team-owned
Version	v1
Category	ownership
Default severity	warning
Interpreter	python3
Timeout	30 seconds
Violations tolerated	0
Collects	codeowners

Collectors

This guardrail gathers nothing itself. It depends on the collectors below, which the CLI runs once per build before any check, and reads what they found out of GUARDRAIL_FACTS. A collector that collects nothing skips this guardrail rather than failing it.

Collector	Gathers	Inputs it is given
codeowners	The CODEOWNERS file the repository carries, read as rules rather than as text: every pattern in file order with the owners it names, how many rules each owner is named by, and the owners that apply to the paths a guardrail asks about, resolved the way GitHub resolves them, where the last rule to match a path is the one that owns it.	none

The inputs above are this guardrail's own, passed straight through. Configuring one in buildnote.json changes what is collected, and two guardrails configured the same way share the one collection.

Configuration

{
  "guardrails": {
      "failOn": "error",
      "comment": true,
      "checks": [
          {
              "use": "ownership/team-owned@v1",
              "severity": "warning",
              "with": {
                  "allowIndividuals": "true"
              },
              "exemptions": []
          }
      ]
  }
}

Inputs

Input	Description	Default	Environment variable
allowIndividuals	Whether a rule naming individuals alongside a team is accepted. Either way the team is required; this only decides whether the individuals beside it are a finding of their own.	true	GUARDRAIL_INPUT_ALLOWINDIVIDUALS

How to fix

Replace the individuals named in the violations with the team they belong to:

-/api/   @dana @sam
+/api/   @acme/backend

A rule naming individuals goes stale the day one of them changes team, and nothing tells you: the forge keeps requesting a review from somebody who no longer works on it. A team owner moves membership out of this file, where it is reviewed, into the team, where it is administered.

More in ownership

• ownership/catch-all-rule. CODEOWNERS declares a rule matching every path, so a file nobody thought about still has an owner.
• ownership/codeowners-parses. Every line of CODEOWNERS that is not a comment reads as a rule, so no ownership is silently lost to a line the forge ignores.
• ownership/codeowners-present. The repository carries a CODEOWNERS file naming at least one rule, so every change has somebody to review it.
• ownership/no-unowned-rules. No rule in CODEOWNERS names an empty set of owners, which would take ownership away from everything it matches.
• ownership/owners-per-rule. Every rule in CODEOWNERS names at least the minimum owners and no more than the maximum, so review is neither one person's bus factor nor everybody's problem.

All 6 ownership guardrails