Replace Dependabot reviewers with CODEOWNERS - #214
Merged
Conversation
GitHub has removed the `reviewers` option from `dependabot.yml` and points users at `CODEOWNERS` instead. `ReplaceDependabotReviewersWithCodeowners` is a scanning recipe that collects the reviewers from each `updates` entry, maps them onto the manifest files Dependabot updates for that `package-ecosystem` and `directory`, and writes them to `CODEOWNERS` before deleting the `reviewers` keys. Mapping to manifests rather than to the whole directory keeps ownership as narrow as the Dependabot configuration was; `CODEOWNERS` applies to every pull request, not just Dependabot's. Ecosystems without a known manifest mapping keep their `reviewers`, as do all entries when an existing `CODEOWNERS` cannot be parsed as text, so the configuration is never dropped without a replacement. Fixes #134
timtebeek
force-pushed
the
tim/dependabot-reviewers-codeowners
branch
from
August 22, 2026 13:24
277b6a9 to
d6675ce
Compare
Review follow-ups on the previous commit: - An unreadable lower-precedence `CODEOWNERS` no longer aborts the migration. A non-`PlainText` `docs/CODEOWNERS` used to set `codeownersIsAppendable` false even when `.github/CODEOWNERS`, the file GitHub actually honors, was perfectly appendable. Appendability is now decided by whichever file wins precedence, independent of the order sources are scanned. - `github-actions` no longer ignores `directory`. A non-root directory points at a composite action definition, so it now maps to `action.yml`/`action.yaml` in that directory rather than over-granting `/.github/workflows/` and leaving the action itself unowned. - Appended lines follow the existing file's line endings instead of always using LF, which produced mixed endings in a CRLF `CODEOWNERS`. - The per-ecosystem `DeleteKey` loop, which re-traversed the document and recompiled a JsonPath for every migrated ecosystem, is now a single pass over an alternation. Note that the previous commit message overstated one guarantee: when a `CODEOWNERS` pattern is already owned by someone else, the Dependabot `reviewers` are still removed without those reviewers being added to the existing line, so that configuration is dropped rather than replaced.
When a pattern we want to add is already present with different owners, the Dependabot `reviewers` were deleted without those reviewers being recorded anywhere, silently dropping the configuration. Appending a second line for the same pattern is not an option either, since CODEOWNERS is last match wins and the new line would displace the owners already there. Merge the reviewers into the existing line instead, so both sets are kept. Owners already on the line are not repeated, so the recipe stays idempotent. This does not address overlapping globs: appending `/pom.xml @acme/backend` below a `* @acme/everyone` still removes `@acme/everyone` as a required reviewer of `pom.xml`. Resolving that needs CODEOWNERS glob matching rather than exact pattern comparison.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
GitHub has removed the
reviewersoption fromdependabot.ymland points users atCODEOWNERSinstead.ReplaceDependabotReviewersWithCodeownersis aScanningRecipethat collects the reviewers from eachupdatesentry, writes them toCODEOWNERS, and deletes thereviewerskeys.Mapping
Reviewers are mapped onto the manifest files Dependabot updates for that
package-ecosystem+directory, not onto the whole directory. This matters:reviewersonly ever applied to Dependabot PRs, whereasCODEOWNERSapplies to every PR, sodirectory: /would otherwise hand a team ownership of the entire repository.github-actionsis special-cased to/.github/workflows/.becomes
Do no harm
reviewers. Rather than falling back to a broader pattern, an ecosystem with no manifest mapping is skipped entirely, so a partial migration is visible rather than silently over-broad.CODEOWNERSblocks the whole migration. If aCODEOWNERSexists but is not parsed as plain text, nothing is deleted — otherwise the reviewers would be dropped with nowhere to record them.CODEOWNERSis appended to, not replaced, honouring GitHub's precedence (.github/> root >docs/). ThecodeownersPathoption (default.github/CODEOWNERS) only applies when creating a new file.Testing
17 tests covering the multi-ecosystem example from the issue,
directories(plural), flow sequences,@-prefixing of bare usernames,CODEOWNERSprecedence, idempotence, and each of the do-no-harm guards above. Full build is green.