Marian has driven the Proxmox integration since the first Proxmox bundle
and is now landing the Cluster API infrastructure provider, CCM and CSI.
Giving him code-owner approval on those packages lets Proxmox changes be
reviewed by the person who knows them best, without granting approval
rights over the rest of the tree.
Assisted-by: LLM
Signed-off-by: tym83 <6355522@gmail.com>
CODEOWNERS applies only the last matching pattern and it replaces every
broader rule including the catch-all, it does not merge them. Half of
what that costs is already fixed: bd7b76691 added the architects to the
rules that were missing them, and hack/codeowners-invariant.bats keeps
them there. That invariant reads "every rule with owners is a superset
of the catch-all owners", and a rule naming nothing but the architects
satisfies it perfectly while gating on two people. Eleven rules on main
have that shape, 182 files between them.
The catch-all is those same two handles, so the invariant makes them
the floor for the whole repository and every path without a rule of its
own sits on that floor. Raising the floor means raising the catch-all,
after which the invariant carries the new set into every rule by
itself. Hence the shape here: the catch-all goes from two owners to
five, and all fifty rules carry those five.
This widens who may approve, not who may change code. Write access is
unchanged for all twelve collaborators, owner approval is OR and always
was, and the required checks that actually hold these paths are
untouched, api-review-gate.yaml included, so a sizeable API change
still needs an approval from one of its own two owners.
Three of the nine maintainers in MAINTAINERS.md own no path, for two
different reasons. c13c6ee2c gave kingdonb the two FluxCD tenant addon
packages and 7cca3d75e deleted them along with the addon, so his rules
went with the packages while the flux paths that stayed were never
handed to him. matthieu-robin and mattia-eleuteri were never in the
file at all. CONTRIBUTOR_LADDER.md says a maintainer may approve
changes to any area of the project.
Rules now group by area rather than by package, every rule names at
least five owners, and an area whose owner set does not differ from its
tier is left to the tier rule. Reviewers keep the areas MAINTAINERS.md
records for them, so that file needs no change.
The two-owner rule on /cmd/api-gate/, /internal/apigate/ and the
api-review-gate workflow goes with the rest. Those paths still require
an owner review, now under the Go source and CI rules.
The invariant test's exemption for a rule owned by exactly tym83 and
kvaps is dead code once the governance block is gone, and dead code in
that position is a hole: any future two-owner rule matching that set
would be waived. Dropping it puts such a rule back under the invariant,
where it belongs.
Signed-off-by: Myasnikov Daniil <myasnikovdaniil2001@gmail.com>
Assisted-by: LLM
The optional `addons.fluxcd` toggle of the Kubernetes app deployed a
Flux Operator + FluxInstance into a tenant cluster. It was served by two
vendored charts, packages/system/fluxcd-operator and packages/system/
fluxcd, which were the last AGPL-3.0 content in this Apache-2.0
repository and a governance blocker for CNCF Incubation.
The management cluster does not use these charts (it runs classic Flux
via internal/fluxinstall; migration 21 already removed the operator from
it), and the addon defaulted to disabled. Rather than maintain an AGPL
payload for an unused feature, drop it entirely:
- delete both system packages and their platform source entries
- remove the addons.fluxcd HelmReleases, values and generated schema
from the Kubernetes app
- drop the addons.fluxcd block still submitted by the e2e harness
- drop the removed fluxcd package entries from CODEOWNERS
BREAKING CHANGE: the addons.fluxcd option of the Kubernetes app is
removed. Tenant clusters that had it enabled keep their running Flux
release; see the companion migration for the upgrade path.
Assisted-By: Claude <noreply@anthropic.com>
Signed-off-by: Andrei Kvapil <andrei.kvapil@aenix.io>
CODEOWNERS applies only the last matching pattern, so a scoped rule
replaces the * catch-all instead of extending it: @kvaps and @lllamnyp
were not code owners for most scoped paths, and several paths (/hack/,
/.github/, /Makefile, /.pre-commit-config.yaml, /docs/) were owned by
exactly two people, deadlocking PRs authored by either of them while
the other is away.
Append @kvaps and @lllamnyp to every rule that lists owners, except the
governance block which deliberately stays with @tym83 @kvaps, and spell
out the non-additive last-match semantics in the file header.
Assisted-By: Claude <noreply@anthropic.com>
Signed-off-by: Andrei Kvapil <andrei.kvapil@aenix.io>
api/apps/v1alpha1/*/types.go and packages/system/*/cozyrds/*.yaml are
entirely produced by `make generate` from each app's own values.yaml,
but the /api/ codeowner rule pulled every app's regenerated types.go
into an architect-only review, regardless of which area actually
changed. Correctness there is already enforced by the pre-commit
make-generate CI hooks, not by human review, so list no owner for
these generated paths and let that check carry the weight instead.
Also fixes a stale api/.gitattributes pattern that never matched any
real file (zz_generated_deepcopy.go vs the actual
zz_generated.deepcopy.go), and adds a matching linguist-generated
attribute for the cozyrds ApplicationDefinition manifests, so both
collapse in the PR diff view like the Go files already do.
Assisted-By: Claude <noreply@anthropic.com>
Signed-off-by: Timofei Larkin <lllamnyp@gmail.com>
The header told the reader to enable "Require review from Code Owners"
for the rules to take effect. It has been enabled on main all along, so
the file reads as a proposal when it is in fact load-bearing from the
commit that lands it.
Spell out the consequence that follows: because GitHub ignores a handle
without write access, scoping a path to someone who lacks it is worse
than naming the wrong person. A wrong owner is visible in review; an
unhonoured one carves the path out from under the catch-all and gates it
on nobody, reporting nothing.
Assisted-By: Claude
Signed-off-by: Andrei Kvapil <andrei.kvapil@aenix.io>
Review on #3228 measured authorship and reviews per path and found the
rules named people who had not touched the code while leaving out those
who had. Rework accordingly.
Close the largest fall-throughs to the catch-all: dashboards, examples
(with the backups subtree routed to its controllers' owners) and tests.
Widen where the data says the list was too short: @lexfrei on the Go
source, cozystack-api, backups and extra; @myasnikovdaniil and @lexfrei
on managed Kubernetes, which also grows from one directory to the whole
area — node pools, resource definitions, kamaji and the CAPI providers
resolved to three different owner sets for one feature.
Narrow where it was too wide: drop @myasnikovdaniil from kubevirt and
kubevirt-cdi at his own request, since he has no activity there.
Drop rules that route nothing: /tools/ and /cmd/cozypkg/ have no human
activity, and the metrics-server rule named a maintainer moving to
emeritus in #3462 with no active owner to replace him -- all three fall
back to a broader rule that already covers them.
Assisted-By: Claude
Signed-off-by: Andrei Kvapil <andrei.kvapil@aenix.io>
Three areas had a clear owner by contribution history and no entry here,
so changes to them routed to the catch-all instead of to the person who
actually maintains them.
kingdonb is the flux owner and holds no write access today, which is the
same governance gap the roster PR fixes; the entry lands with it. GPU
work (hami, gpu-operator, the GPU dashboards) went to lexfrei when he
picked it up. metrics-server and seaweedfs follow nbykov0, with
sircthulhu on the extra/ variant he has been carrying.
Assisted-By: Claude
Signed-off-by: Andrei Kvapil <andrei.kvapil@aenix.io>
Replace the single catch-all owner line with area-scoped reviewer ownership per the Contributor Ladder. Ordering is broad -> specific (last match wins); the API review gate block stays last so it cannot be overridden. Review-routing only, no runtime change.
Assisted-By: Claude
Signed-off-by: Andrei Kvapil <andrei.kvapil@aenix.io>
Bring the security documentation in line with controls that are already
in place, and add the two coordinated-disclosure items flagged during the
incubation due-diligence review.
- self-assessment: DCO is enforced by an automated check; private intake
is GitHub Private Vulnerability Reporting; OpenSSF passing badge achieved
2026-04-01 (working toward silver); GHSA/PVR framing for advisory history;
incident-response now summarized publicly.
- SECURITY.md: route reports to Private Vulnerability Reporting with a
MAINTAINERS.md fallback; add a 90-day coordinated-disclosure window and a
CVSS-based remediation-target table.
- CODEOWNERS: document that it encodes the area-scoped Reviewer role, which
is intentionally distinct from the MAINTAINERS.md governance roster, and
that security reporting is not routed through this file.
- Add docs/security/incident-response.md as the public incident runbook.
Co-Authored-By: Claude <noreply@anthropic.com>
Signed-off-by: tym83 <6355522@gmail.com>
Scope the gate's own files (cmd/api-gate, internal/apigate, the workflow) to the API owners in CODEOWNERS, and compile the detector from the trusted base checkout when present (head fallback only during bootstrap), so a PR cannot neuter the gate by editing its own detector code.
Detect two more breaking vectors: removing nullable:true (rejects null) and adding a oneOf/allOf/not composition constraint. Both covered by regression tests.
Assisted-By: Claude <noreply@anthropic.com>
Signed-off-by: Timofei Larkin <lllamnyp@gmail.com>
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
- **Chores**
- Updated internal team management roles to include an additional
responsible contributor.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
tym83