Onboard a repo

CODEOWNERS

Reference shape of the CODEOWNERS pattern redline init seeds — the CLI generates the real content in code, it doesn't read this file.

What this is

The CODEOWNERS pattern that protects the enforcement surface: the paths that control what the gate checks and how strictly.

How to onboard it

  • Installed as: .github/CODEOWNERS
  • Installed by: redline init --with review-ownership, and only on a repo that has none yet — an existing CODEOWNERS, in any of the three locations GitHub recognises, is left untouched. It is off by default: the generated file names an owner Redline cannot prove exists, and a ruleset requiring code-owner review with an unresolvable owner blocks every pull request in the repository. Ask for it once you know the team or user in it is real.

How to use it

If you widen what redline init actually generates, edit the SENSITIVE_PATHS list in cli/commands/init.ts — editing this file changes nothing about the CLI's output.

  • "Protects the enforcement surface" means: without a code-owner rule on the files that define the gate, the branch ruleset's require_code_owner_review is a silent no-op, and any contributor could edit .github/workflows/, CODEOWNERS itself, or the rendered standards files in a self-approved PR — quietly weakening their own review, undetected.
  • The CLI does not read this checked-in template file at install time — it generates .github/CODEOWNERS content in code, from a hardcoded rule list in cli/commands/init.ts, always owned by @platform-engineering with no placeholder to fill in.
  • This template file covers a broader set of paths than the generated version does (it also lists .github/copilot-instructions.md, AGENTS.md, CLAUDE.md, infra/, terraform/, Dockerfile) — treat it as a fuller reference pattern, not a preview of exactly what a fresh redline init writes.

Expected output

.github/CODEOWNERS in the onboarded repository, listing the paths that define the gate, owned by @platform-engineering. Combined with the ruleset's require_code_owner_review it is what stops a contributor from weakening their own gate in a self-approved pull request. Without it that ruleset setting is a silent no-op.

How to edit it

The real source: cli/commands/init.ts — the SENSITIVE_PATHS list. The CLI generates this content in code and never opens the checked-in template, so editing the file you see here changes nothing about what redline init writes.

  1. Check whether the CLI reads this file at allSeveral of these are reference shapes: the CLI generates the equivalent in code and never opens the checked-in copy. Editing one of those changes nothing about what redline init writes. The onboarding section above says which kind this is.
  2. Edit the real sourceFor a generated artifact that is cli/commands/init.ts; for a file installed verbatim it is the template itself.
  3. npm test && node scripts/validate.mjsThe install path is unit-tested against a fake host client, and validate.mjs pins the shapes the merge gate's required check name depends on.

The full file

templates/CODEOWNERS · 30 lines · 1.7 KB
# Reference shape only. `redline init` builds equivalent content in code and never reads
# this file — it writes .github/CODEOWNERS only on a repository that has none yet, and
# leaves an existing one untouched.
#
# The branch ruleset sets require_code_owner_review: true. Without a CODEOWNERS file that
# rule is a silent no-op, so the platform team must own at minimum the enforcement surface
# below — otherwise any contributor can weaken their own gate in a self-approved PR.
#
# Replace <org>/<team> placeholders before installing by hand.

# Default owner for everything not matched below.
*                                   @<org>/<owning-team>

# --- Enforcement surface: platform team must approve any change here -------------------
# Editing the caller workflow, the ruleset, or the review standards changes what this
# repo is allowed to merge. These are the paths an attacker or a rushed engineer would
# touch to make the gate stop failing.
/.github/workflows/                 @<org>/platform-engineering
/.github/CODEOWNERS                 @<org>/platform-engineering
/.github/copilot-instructions.md    @<org>/platform-engineering
/.github/instructions/              @<org>/platform-engineering
/AGENTS.md                          @<org>/platform-engineering
/CLAUDE.md                          @<org>/platform-engineering

# --- Security-sensitive paths ---------------------------------------------------------
/infra/                             @<org>/platform-engineering
/terraform/                         @<org>/platform-engineering
Dockerfile                          @<org>/platform-engineering
/.github/dependabot.yml             @<org>/platform-engineering