From 0ff44017786ee28ad707ac1da86c940216c5a96b Mon Sep 17 00:00:00 2001 From: David McKay Date: Sun, 16 Aug 2026 19:45:42 -0700 Subject: [PATCH] Require a maintainer's approval to merge The repository inherits a collaborator list from the organisation, so about a dozen people can push and, with no review required, merge their own work. That is the wrong default for a public repository. Name the owners explicitly so the protection rule on main has somebody to demand an approval from. --- .github/CODEOWNERS | 15 +++++++++++++++ 1 file changed, 15 insertions(+) create mode 100644 .github/CODEOWNERS diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS new file mode 100644 index 00000000..480e2efd --- /dev/null +++ b/.github/CODEOWNERS @@ -0,0 +1,15 @@ +# Who has to approve a change before it can reach main. +# +# This repository is public and its collaborator list is inherited from the +# organisation, so a great many people can open and push branches. Merging is +# deliberately narrower: `main` requires an approving review from an owner +# listed here. +# +# Widening this list widens who can approve. Add people who know the codebase +# well enough to say no. + +* @davidmckayv @guidovizoso + +# Workflows are the supply chain. A change here runs with the repository's +# credentials, so engineering reviews it alongside the owners above. +/.github/workflows/ @CopilotKit/engineering @davidmckayv @guidovizoso