From e677f4378366c3db291f94eac7a2efc505bf5816 Mon Sep 17 00:00:00 2001 From: Andrei Kvapil Date: Tue, 7 Jul 2026 12:43:47 +0200 Subject: [PATCH 1/7] chore(codeowners): scope CODEOWNERS to per-area reviewers Replace the single catch-all owner line with area-scoped reviewer ownership per the Contributor Ladder. Ordering is broad -> specific (last match wins); the API review gate block stays last so it cannot be overridden. Review-routing only, no runtime change. Assisted-By: Claude Signed-off-by: Andrei Kvapil --- .github/CODEOWNERS | 73 +++++++++++++++++++++++++++++++++++++++++++++- 1 file changed, 72 insertions(+), 1 deletion(-) diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS index 494bb3bb8..bdb03bd54 100644 --- a/.github/CODEOWNERS +++ b/.github/CODEOWNERS @@ -5,8 +5,79 @@ # Maintainer is responsible for the whole project. The two overlap but are not # identical by design. Security reports are NOT routed through this file; see # SECURITY.md (GitHub Private Vulnerability Reporting + MAINTAINERS.md). +# +# Ordering matters: CODEOWNERS applies the LAST matching pattern, so entries go +# from broad to specific. The API review gate block stays last so it cannot be +# overridden. Enable "Require review from Code Owners" in branch protection for +# these to bind. -* @kvaps @lllamnyp @lexfrei @androndo @IvanHunters @sircthulhu @myasnikovdaniil +# --- Default: architects own anything not scoped below --- +* @kvaps @lllamnyp + +# --- All packages: general owners (overridden by the specific areas below) --- +/packages/ @lexfrei @IvanHunters @myasnikovdaniil + +# --- Apps: default owners (specific apps overridden below) --- +/packages/apps/ @lexfrei @IvanHunters @myasnikovdaniil @scooby87 +/packages/apps/kubernetes/ @IvanHunters @kvaps +/packages/apps/vm-instance/ @scooby87 @lllamnyp @kvaps @myasnikovdaniil +/packages/apps/vm-disk/ @scooby87 @lllamnyp @kvaps @myasnikovdaniil +/packages/apps/vpc/ @kvaps @lllamnyp + +# --- Extra apps --- +/packages/extra/ @kvaps @lllamnyp @IvanHunters + +# --- Virtualization (system side) --- +/packages/system/kubevirt/ @scooby87 @lllamnyp @kvaps @myasnikovdaniil +/packages/system/kubevirt-cdi/ @scooby87 @lllamnyp @kvaps @myasnikovdaniil +/packages/system/kubevirt-cdi-operator/ @scooby87 @lllamnyp @kvaps @myasnikovdaniil +/packages/system/kubevirt-operator/ @scooby87 @lllamnyp @kvaps @myasnikovdaniil +/packages/system/kubevirt-instancetypes/ @scooby87 @lllamnyp @kvaps @myasnikovdaniil +/packages/system/kubevirt-csi-node/ @scooby87 @lllamnyp @kvaps @myasnikovdaniil +/packages/system/vm-default-images/ @scooby87 @lllamnyp @kvaps @myasnikovdaniil + +# --- Backups --- +/packages/system/backup-controller/ @androndo @lllamnyp +/packages/system/backupstrategy-controller/ @androndo @lllamnyp +/packages/system/velero/ @androndo @lllamnyp +/cmd/backup-controller/ @androndo @lllamnyp +/cmd/backupstrategy-controller/ @androndo @lllamnyp + +# --- cozystack-api / controller / lineage webhook --- +/packages/system/cozystack-api/ @IvanHunters @kvaps @lllamnyp +/packages/system/cozystack-controller/ @IvanHunters @kvaps @lllamnyp +/packages/system/lineage-controller-webhook/ @IvanHunters @kvaps @lllamnyp +/cmd/cozystack-api/ @IvanHunters @kvaps @lllamnyp +/cmd/cozystack-controller/ @IvanHunters @kvaps @lllamnyp +/cmd/lineage-controller-webhook/ @IvanHunters @kvaps @lllamnyp + +# --- CLI tooling --- +/cmd/cozypkg/ @lexfrei @IvanHunters @myasnikovdaniil +/tools/ @lexfrei @IvanHunters @myasnikovdaniil + +# --- API surface (architects) --- +/api/ @kvaps @lllamnyp + +# --- Docs --- +/docs/ @lexfrei @myasnikovdaniil + +# --- CI / automation --- +/.github/ @myasnikovdaniil @sircthulhu +/hack/ @myasnikovdaniil @sircthulhu +/Makefile @myasnikovdaniil @sircthulhu +/.pre-commit-config.yaml @myasnikovdaniil @sircthulhu + +# --- Governance, licensing, project docs --- +/LICENSE @tym83 @kvaps +/GOVERNANCE.md @tym83 @kvaps +/MAINTAINERS.md @tym83 @kvaps +/CONTRIBUTOR_LADDER.md @tym83 @kvaps +/CODE_OF_CONDUCT.md @tym83 @kvaps +/CONTRIBUTING.md @tym83 @kvaps +/SECURITY.md @tym83 @kvaps +/ADOPTERS.md @tym83 @kvaps +/README.md @tym83 @kvaps +/.github/CODEOWNERS @kvaps @lllamnyp # The API review gate must not be editable without an API-owner review, or a # PR could neuter the detector (it is compiled from the head checkout during From 7dd42290152076f0cb0cb2441978bd55576077c9 Mon Sep 17 00:00:00 2001 From: Andrei Kvapil Date: Tue, 7 Jul 2026 12:46:29 +0200 Subject: [PATCH 2/7] chore(codeowners): add packages/core and pkg api/registry owners Assisted-By: Claude Signed-off-by: Andrei Kvapil --- .github/CODEOWNERS | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS index bdb03bd54..2ff9afdef 100644 --- a/.github/CODEOWNERS +++ b/.github/CODEOWNERS @@ -27,6 +27,9 @@ # --- Extra apps --- /packages/extra/ @kvaps @lllamnyp @IvanHunters +# --- Core (installer / platform / talos / flux-aio) --- +/packages/core/ @lllamnyp @kvaps @myasnikovdaniil @IvanHunters @lexfrei + # --- Virtualization (system side) --- /packages/system/kubevirt/ @scooby87 @lllamnyp @kvaps @myasnikovdaniil /packages/system/kubevirt-cdi/ @scooby87 @lllamnyp @kvaps @myasnikovdaniil @@ -55,8 +58,12 @@ /cmd/cozypkg/ @lexfrei @IvanHunters @myasnikovdaniil /tools/ @lexfrei @IvanHunters @myasnikovdaniil -# --- API surface (architects) --- +# --- API surface (architects): API types, aggregated apiserver, registry --- /api/ @kvaps @lllamnyp +/pkg/apis/ @kvaps @lllamnyp +/pkg/apiserver/ @kvaps @lllamnyp +/pkg/registry/ @kvaps @lllamnyp +/pkg/generated/ @kvaps @lllamnyp # --- Docs --- /docs/ @lexfrei @myasnikovdaniil From 3e9ddd7e4529ddfbdd846b7d8fdb40970c65151b Mon Sep 17 00:00:00 2001 From: Andrei Kvapil Date: Tue, 7 Jul 2026 12:50:55 +0200 Subject: [PATCH 3/7] chore(codeowners): swap @sircthulhu for @lexfrei on CI paths Assisted-By: Claude Signed-off-by: Andrei Kvapil --- .github/CODEOWNERS | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS index 2ff9afdef..7dc4cd1ff 100644 --- a/.github/CODEOWNERS +++ b/.github/CODEOWNERS @@ -69,10 +69,10 @@ /docs/ @lexfrei @myasnikovdaniil # --- CI / automation --- -/.github/ @myasnikovdaniil @sircthulhu -/hack/ @myasnikovdaniil @sircthulhu -/Makefile @myasnikovdaniil @sircthulhu -/.pre-commit-config.yaml @myasnikovdaniil @sircthulhu +/.github/ @myasnikovdaniil @lexfrei +/hack/ @myasnikovdaniil @lexfrei +/Makefile @myasnikovdaniil @lexfrei +/.pre-commit-config.yaml @myasnikovdaniil @lexfrei # --- Governance, licensing, project docs --- /LICENSE @tym83 @kvaps From 6f9a7af1f6a89794536a7d0c4e7d6633631320a3 Mon Sep 17 00:00:00 2001 From: Andrei Kvapil Date: Tue, 7 Jul 2026 13:14:12 +0200 Subject: [PATCH 4/7] chore(codeowners): add @sircthulhu to Go source, packages, keycloak Assisted-By: Claude Signed-off-by: Andrei Kvapil --- .github/CODEOWNERS | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-) diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS index 7dc4cd1ff..07a119521 100644 --- a/.github/CODEOWNERS +++ b/.github/CODEOWNERS @@ -15,7 +15,12 @@ * @kvaps @lllamnyp # --- All packages: general owners (overridden by the specific areas below) --- -/packages/ @lexfrei @IvanHunters @myasnikovdaniil +/packages/ @lexfrei @IvanHunters @myasnikovdaniil @sircthulhu + +# --- Go source: general owners (specific cmd/pkg areas overridden below) --- +/cmd/ @kvaps @lllamnyp @sircthulhu +/internal/ @kvaps @lllamnyp @sircthulhu +/pkg/ @kvaps @lllamnyp @sircthulhu # --- Apps: default owners (specific apps overridden below) --- /packages/apps/ @lexfrei @IvanHunters @myasnikovdaniil @scooby87 @@ -54,6 +59,11 @@ /cmd/cozystack-controller/ @IvanHunters @kvaps @lllamnyp /cmd/lineage-controller-webhook/ @IvanHunters @kvaps @lllamnyp +# --- Keycloak --- +/packages/system/keycloak/ @sircthulhu @lexfrei @IvanHunters @myasnikovdaniil +/packages/system/keycloak-operator/ @sircthulhu @lexfrei @IvanHunters @myasnikovdaniil +/packages/system/keycloak-configure/ @sircthulhu @lexfrei @IvanHunters @myasnikovdaniil + # --- CLI tooling --- /cmd/cozypkg/ @lexfrei @IvanHunters @myasnikovdaniil /tools/ @lexfrei @IvanHunters @myasnikovdaniil From c13c6ee2cacf72c17abc09fdfb53decd769f5af6 Mon Sep 17 00:00:00 2001 From: Andrei Kvapil Date: Mon, 27 Jul 2026 21:19:41 +0200 Subject: [PATCH 5/7] chore(codeowners): add flux, GPU and storage-metrics areas Three areas had a clear owner by contribution history and no entry here, so changes to them routed to the catch-all instead of to the person who actually maintains them. kingdonb is the flux owner and holds no write access today, which is the same governance gap the roster PR fixes; the entry lands with it. GPU work (hami, gpu-operator, the GPU dashboards) went to lexfrei when he picked it up. metrics-server and seaweedfs follow nbykov0, with sircthulhu on the extra/ variant he has been carrying. Assisted-By: Claude Signed-off-by: Andrei Kvapil --- .github/CODEOWNERS | 14 ++++++++++++++ 1 file changed, 14 insertions(+) diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS index 07a119521..5b028d578 100644 --- a/.github/CODEOWNERS +++ b/.github/CODEOWNERS @@ -51,6 +51,20 @@ /cmd/backup-controller/ @androndo @lllamnyp /cmd/backupstrategy-controller/ @androndo @lllamnyp +# --- Flux --- +/packages/system/fluxcd/ @kingdonb @kvaps @lllamnyp +/packages/system/fluxcd-operator/ @kingdonb @kvaps @lllamnyp + +# --- GPU --- +/packages/system/hami/ @lexfrei @kvaps +/packages/system/gpu-operator/ @lexfrei @kvaps +/dashboards/gpu/ @lexfrei @kvaps + +# --- Storage and metrics plumbing --- +/packages/system/metrics-server/ @nbykov0 @IvanHunters +/packages/system/seaweedfs/ @nbykov0 @IvanHunters +/packages/extra/seaweedfs/ @nbykov0 @sircthulhu + # --- cozystack-api / controller / lineage webhook --- /packages/system/cozystack-api/ @IvanHunters @kvaps @lllamnyp /packages/system/cozystack-controller/ @IvanHunters @kvaps @lllamnyp From bf8c5b3fbcb188130dc6e274f2aa8b37b863a4c2 Mon Sep 17 00:00:00 2001 From: Andrei Kvapil Date: Tue, 28 Jul 2026 17:28:10 +0200 Subject: [PATCH 6/7] chore(codeowners): rework ownership from contribution data MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Review on #3228 measured authorship and reviews per path and found the rules named people who had not touched the code while leaving out those who had. Rework accordingly. Close the largest fall-throughs to the catch-all: dashboards, examples (with the backups subtree routed to its controllers' owners) and tests. Widen where the data says the list was too short: @lexfrei on the Go source, cozystack-api, backups and extra; @myasnikovdaniil and @lexfrei on managed Kubernetes, which also grows from one directory to the whole area — node pools, resource definitions, kamaji and the CAPI providers resolved to three different owner sets for one feature. Narrow where it was too wide: drop @myasnikovdaniil from kubevirt and kubevirt-cdi at his own request, since he has no activity there. Drop rules that route nothing: /tools/ and /cmd/cozypkg/ have no human activity, and the metrics-server rule named a maintainer moving to emeritus in #3462 with no active owner to replace him -- all three fall back to a broader rule that already covers them. Assisted-By: Claude Signed-off-by: Andrei Kvapil --- .github/CODEOWNERS | 64 +++++++++++++++++++++++++++------------------- 1 file changed, 38 insertions(+), 26 deletions(-) diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS index 5b028d578..25bf8f3fc 100644 --- a/.github/CODEOWNERS +++ b/.github/CODEOWNERS @@ -14,74 +14,86 @@ # --- Default: architects own anything not scoped below --- * @kvaps @lllamnyp +# --- Dashboards, examples, tests (largest fall-throughs to the default) --- +/dashboards/ @myasnikovdaniil @IvanHunters +/examples/ @lllamnyp @myasnikovdaniil +/examples/backups/ @androndo @lllamnyp +/test/ @myasnikovdaniil + # --- All packages: general owners (overridden by the specific areas below) --- /packages/ @lexfrei @IvanHunters @myasnikovdaniil @sircthulhu # --- Go source: general owners (specific cmd/pkg areas overridden below) --- -/cmd/ @kvaps @lllamnyp @sircthulhu -/internal/ @kvaps @lllamnyp @sircthulhu -/pkg/ @kvaps @lllamnyp @sircthulhu +/cmd/ @kvaps @lllamnyp @sircthulhu @lexfrei +/internal/ @kvaps @lllamnyp @sircthulhu @lexfrei +/pkg/ @kvaps @lllamnyp @sircthulhu @lexfrei # --- Apps: default owners (specific apps overridden below) --- /packages/apps/ @lexfrei @IvanHunters @myasnikovdaniil @scooby87 -/packages/apps/kubernetes/ @IvanHunters @kvaps /packages/apps/vm-instance/ @scooby87 @lllamnyp @kvaps @myasnikovdaniil /packages/apps/vm-disk/ @scooby87 @lllamnyp @kvaps @myasnikovdaniil /packages/apps/vpc/ @kvaps @lllamnyp +# --- Managed Kubernetes: app chart, node pools, resource definitions, control plane, CAPI --- +/packages/apps/kubernetes/ @IvanHunters @kvaps @myasnikovdaniil @lexfrei +/packages/apps/kubernetes-nodes/ @IvanHunters @kvaps @myasnikovdaniil @lexfrei +/packages/system/kubernetes-rd/ @IvanHunters @kvaps @myasnikovdaniil @lexfrei +/packages/system/kubernetes-nodes-rd/ @IvanHunters @kvaps @myasnikovdaniil @lexfrei +/packages/system/kamaji/ @IvanHunters @kvaps @myasnikovdaniil @lexfrei +/packages/system/capi-operator/ @IvanHunters @kvaps @myasnikovdaniil @lexfrei +/packages/system/capi-providers-core/ @IvanHunters @kvaps @myasnikovdaniil @lexfrei +/packages/system/capi-providers-bootstrap/ @IvanHunters @kvaps @myasnikovdaniil @lexfrei +/packages/system/capi-providers-cpprovider/ @IvanHunters @kvaps @myasnikovdaniil @lexfrei +/packages/system/capi-providers-infraprovider/ @IvanHunters @kvaps @myasnikovdaniil @lexfrei + # --- Extra apps --- -/packages/extra/ @kvaps @lllamnyp @IvanHunters +/packages/extra/ @kvaps @lllamnyp @IvanHunters @lexfrei @myasnikovdaniil # --- Core (installer / platform / talos / flux-aio) --- /packages/core/ @lllamnyp @kvaps @myasnikovdaniil @IvanHunters @lexfrei # --- Virtualization (system side) --- -/packages/system/kubevirt/ @scooby87 @lllamnyp @kvaps @myasnikovdaniil -/packages/system/kubevirt-cdi/ @scooby87 @lllamnyp @kvaps @myasnikovdaniil +/packages/system/kubevirt/ @scooby87 @lllamnyp @kvaps @lexfrei +/packages/system/kubevirt-cdi/ @scooby87 @lllamnyp @kvaps /packages/system/kubevirt-cdi-operator/ @scooby87 @lllamnyp @kvaps @myasnikovdaniil -/packages/system/kubevirt-operator/ @scooby87 @lllamnyp @kvaps @myasnikovdaniil +/packages/system/kubevirt-operator/ @scooby87 @lllamnyp @kvaps @myasnikovdaniil @IvanHunters /packages/system/kubevirt-instancetypes/ @scooby87 @lllamnyp @kvaps @myasnikovdaniil /packages/system/kubevirt-csi-node/ @scooby87 @lllamnyp @kvaps @myasnikovdaniil /packages/system/vm-default-images/ @scooby87 @lllamnyp @kvaps @myasnikovdaniil # --- Backups --- -/packages/system/backup-controller/ @androndo @lllamnyp +/packages/system/backup-controller/ @androndo @lllamnyp @lexfrei /packages/system/backupstrategy-controller/ @androndo @lllamnyp -/packages/system/velero/ @androndo @lllamnyp +/packages/system/velero/ @androndo @lllamnyp @lexfrei /cmd/backup-controller/ @androndo @lllamnyp /cmd/backupstrategy-controller/ @androndo @lllamnyp # --- Flux --- -/packages/system/fluxcd/ @kingdonb @kvaps @lllamnyp -/packages/system/fluxcd-operator/ @kingdonb @kvaps @lllamnyp +/packages/system/fluxcd/ @kingdonb @kvaps @lllamnyp @myasnikovdaniil +/packages/system/fluxcd-operator/ @kingdonb @kvaps @lllamnyp @myasnikovdaniil # --- GPU --- /packages/system/hami/ @lexfrei @kvaps /packages/system/gpu-operator/ @lexfrei @kvaps /dashboards/gpu/ @lexfrei @kvaps -# --- Storage and metrics plumbing --- -/packages/system/metrics-server/ @nbykov0 @IvanHunters -/packages/system/seaweedfs/ @nbykov0 @IvanHunters -/packages/extra/seaweedfs/ @nbykov0 @sircthulhu +# --- SeaweedFS --- +/packages/system/seaweedfs/ @IvanHunters @lexfrei @myasnikovdaniil +/packages/extra/seaweedfs/ @sircthulhu @lexfrei @myasnikovdaniil # --- cozystack-api / controller / lineage webhook --- -/packages/system/cozystack-api/ @IvanHunters @kvaps @lllamnyp -/packages/system/cozystack-controller/ @IvanHunters @kvaps @lllamnyp -/packages/system/lineage-controller-webhook/ @IvanHunters @kvaps @lllamnyp -/cmd/cozystack-api/ @IvanHunters @kvaps @lllamnyp -/cmd/cozystack-controller/ @IvanHunters @kvaps @lllamnyp -/cmd/lineage-controller-webhook/ @IvanHunters @kvaps @lllamnyp +/packages/system/cozystack-api/ @IvanHunters @kvaps @lllamnyp @lexfrei +/packages/system/cozystack-controller/ @IvanHunters @kvaps @lllamnyp @lexfrei +/packages/system/lineage-controller-webhook/ @IvanHunters @kvaps @lllamnyp @lexfrei +/cmd/cozystack-api/ @IvanHunters @kvaps @lllamnyp @lexfrei +/cmd/cozystack-controller/ @IvanHunters @kvaps @lllamnyp @lexfrei +/cmd/lineage-controller-webhook/ @IvanHunters @kvaps @lllamnyp @lexfrei # --- Keycloak --- /packages/system/keycloak/ @sircthulhu @lexfrei @IvanHunters @myasnikovdaniil /packages/system/keycloak-operator/ @sircthulhu @lexfrei @IvanHunters @myasnikovdaniil /packages/system/keycloak-configure/ @sircthulhu @lexfrei @IvanHunters @myasnikovdaniil -# --- CLI tooling --- -/cmd/cozypkg/ @lexfrei @IvanHunters @myasnikovdaniil -/tools/ @lexfrei @IvanHunters @myasnikovdaniil - # --- API surface (architects): API types, aggregated apiserver, registry --- /api/ @kvaps @lllamnyp /pkg/apis/ @kvaps @lllamnyp From 23f1b926c9735053f145163ed66a2a3d41757024 Mon Sep 17 00:00:00 2001 From: Andrei Kvapil Date: Tue, 28 Jul 2026 17:36:01 +0200 Subject: [PATCH 7/7] chore(codeowners): say that the rules bind today The header told the reader to enable "Require review from Code Owners" for the rules to take effect. It has been enabled on main all along, so the file reads as a proposal when it is in fact load-bearing from the commit that lands it. Spell out the consequence that follows: because GitHub ignores a handle without write access, scoping a path to someone who lacks it is worse than naming the wrong person. A wrong owner is visible in review; an unhonoured one carves the path out from under the catch-all and gates it on nobody, reporting nothing. Assisted-By: Claude Signed-off-by: Andrei Kvapil --- .github/CODEOWNERS | 14 ++++++++++---- 1 file changed, 10 insertions(+), 4 deletions(-) diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS index 25bf8f3fc..044688312 100644 --- a/.github/CODEOWNERS +++ b/.github/CODEOWNERS @@ -8,8 +8,14 @@ # # Ordering matters: CODEOWNERS applies the LAST matching pattern, so entries go # from broad to specific. The API review gate block stays last so it cannot be -# overridden. Enable "Require review from Code Owners" in branch protection for -# these to bind. +# overridden. +# +# "Require review from Code Owners" is already enabled on main, so these rules +# gate merges from the moment this file lands — they are not an intention to be +# tightened later. That makes an unhonoured owner worse than a wrong one: GitHub +# ignores a handle without write access, so scoping a path to someone who lacks +# it carves that path out from under the catch-all and leaves it gating on +# nobody, without reporting anything. # --- Default: architects own anything not scoped below --- * @kvaps @lllamnyp @@ -126,8 +132,8 @@ # PR could neuter the detector (it is compiled from the head checkout during # bootstrap) and slip a sizeable API change through unreviewed. Scoping these # paths to the API owners overrides the catch-all above (last match wins), so -# changes here require @kvaps or @lllamnyp specifically. Enable "Require review -# from Code Owners" in branch protection for this to bind. +# changes here require @kvaps or @lllamnyp specifically. This is in force today, +# not pending a branch-protection change. /cmd/api-gate/ @kvaps @lllamnyp /internal/apigate/ @kvaps @lllamnyp /.github/workflows/api-review-gate.yaml @kvaps @lllamnyp