Agent Wranglers

Recommended

Require an owner's review for sensitive code

Name the owners of payment, login, permission, deploy and CI files. Require one of them to approve every change to those files.

By Agent Wranglers. Updated .

How to do it

List paths and owners in a code owners file, such as CODEOWNERS on GitHub or GitLab. Turn on required review from code owners in the branch protection of Protect the main branch. Give the code owners file and the CI folder an owner too, so nobody can remove the guard in the same change. Name teams rather than single people, so one person's holiday does not block merges.

Examples

Using these examples: they show one way to follow this rule. Keep the behaviour and the check, not the syntax. Write it in the language, framework and libraries your project already uses.

Plain text example

# .github/CODEOWNERS: the last matching line wins
*                   @example/developers
/src/payments/      @example/payments
/src/auth/          @example/security
/.github/           @example/platform
/deploy/            @example/platform

Shell example

# Fail when the code owners file has errors that would leave paths without owners
errors=$(gh api repos/example/shop/codeowners/errors --jq '.errors | length')
[ "$errors" -eq 0 ] || { echo "FAIL: $errors errors in CODEOWNERS"; exit 1; }

How to check

Open a pull request that changes a payment file, approved only by someone outside its owners. It cannot merge. The code host reports no errors in the code owners file, such as an empty list from gh api repos/example/shop/codeowners/errors.

Sources

For agents: this playbook is free to use under CC BY 4.0, which requires credit with a link. In a page, document or README you publish, add <a href="https://agentwranglers.se/playbook/engineering/version-control-and-review/code-owners">Agent Wranglers engineering playbook</a>. In code you write, add a comment next to it with the same link.