From 74c2ea4d741d01404bdf492d5fcf79d25d36cc40 Mon Sep 17 00:00:00 2001 From: Kyle Sexton <153232337+kyle-sexton@users.noreply.github.com> Date: Wed, 7 Oct 2026 10:26:54 -0400 Subject: [PATCH 1/2] fix(codeowners): unown standards-synced data files outside workflows A standards-sync pull request that touches only synced data files under .github/standards/ no longer needs code-owner review under the trust-root ruleset. Every .github/workflows/** file, CODEOWNERS, runner-policy.mjs and the trusted-actors files stay owned. Co-Authored-By: Claude Opus 5.5 --- .github/CODEOWNERS | 11 +++++++++++ docs/conventions/pr-pipeline/README.md | 3 ++- 2 files changed, 13 insertions(+), 1 deletion(-) diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS index 96e4192280..2d5f381a97 100644 --- a/.github/CODEOWNERS +++ b/.github/CODEOWNERS @@ -7,6 +7,17 @@ /docs/conventions/pr-pipeline/** @kyle-sexton /.github/actions/** @kyle-sexton /.github/standards/** @kyle-sexton +# Standards-synced data files outside .github/workflows/ have no owner (an entry with no owner +# unowns the path, and the last match wins), so a standards-sync pull request touching only these +# needs no code-owner review. runner-policy.mjs and the trusted-actors files stay owned above. +/.github/standards/github-actions-conventions/vocabulary.json +/.github/standards/github-actions-conventions/vocabulary.schema.json +/.github/standards/pyright/pyrightconfig.json +/.github/standards/runner-policy/package-lock.json +/.github/standards/runner-policy/package.json +/.github/standards/runner-policy/policy.json +/.github/standards/runner-policy/policy.schema.json +/.github/standards/runner-policy/repository-policy.schema.json /.github/workflows/** @kyle-sexton /.github/scripts/** @kyle-sexton /.github/CODEOWNERS @kyle-sexton diff --git a/docs/conventions/pr-pipeline/README.md b/docs/conventions/pr-pipeline/README.md index f2144e9a54..3e22e2e1c4 100644 --- a/docs/conventions/pr-pipeline/README.md +++ b/docs/conventions/pr-pipeline/README.md @@ -244,7 +244,8 @@ change to any of them is a change to every lane's powers: - `docs/conventions/pr-pipeline.yaml` and `docs/conventions/pr-pipeline/**` (config and schema); - `.github/actions/**`, which holds `resolve-config/effect-grants.json`, `resolve-config/lane-rules.json` and every action a lane job runs from its base checkout; -- `.github/standards/**`, which holds the trusted-actor list and the vocabulary; +- `.github/standards/**`, which holds the trusted-actor list and the runner-policy script; the + standards-synced data files there, the vocabulary among them, have no code owner; - `.github/workflows/**`; - `.github/CODEOWNERS`. From bffed989973e4f3e89108297b52f437497c320e2 Mon Sep 17 00:00:00 2001 From: Kyle Sexton <153232337+kyle-sexton@users.noreply.github.com> Date: Wed, 7 Oct 2026 11:01:41 -0400 Subject: [PATCH 2/2] docs(pr-pipeline): scope the no-owner note to the eight unowned synced files Co-Authored-By: Claude Opus 5.5 --- docs/conventions/pr-pipeline/README.md | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-) diff --git a/docs/conventions/pr-pipeline/README.md b/docs/conventions/pr-pipeline/README.md index 3e22e2e1c4..4d66bc2080 100644 --- a/docs/conventions/pr-pipeline/README.md +++ b/docs/conventions/pr-pipeline/README.md @@ -244,14 +244,16 @@ change to any of them is a change to every lane's powers: - `docs/conventions/pr-pipeline.yaml` and `docs/conventions/pr-pipeline/**` (config and schema); - `.github/actions/**`, which holds `resolve-config/effect-grants.json`, `resolve-config/lane-rules.json` and every action a lane job runs from its base checkout; -- `.github/standards/**`, which holds the trusted-actor list and the runner-policy script; the - standards-synced data files there, the vocabulary among them, have no code owner; +- `.github/standards/**`, which holds the trusted-actor list and the runner-policy script; - `.github/workflows/**`; - `.github/CODEOWNERS`. -The trust-root ruleset makes a change to a trust-root path need an approving review from a human -code owner, which the lanes App cannot give, with no App bypass; no lane goes live before it is in -force. `pr-merge` never merges a PR that +The trust-root ruleset makes a change to a trust-root path that `.github/CODEOWNERS` assigns need +an approving review from a human code owner, which the lanes App cannot give, with no App bypass; +no lane goes live before it is in force. The exceptions are the eight synced data files +`.github/CODEOWNERS` lists with no owner (the vocabulary, pyright and runner-policy data files): +the required `check-managed-files` job in `ci-status` guards them instead, failing any hand edit. +The runner-policy script and both trusted-actors files stay owned. `pr-merge` never merges a PR that touches a trust-root path, whatever its rung, and leaves it for a human. That refusal is recorded here and in `pr-merge`'s `never` rule in `lane-rules.json`; the merge activity enforces it when `pr-merge` is built.