From 4aca565a47ae53bb0a606cdb0017f2924654278f Mon Sep 17 00:00:00 2001 From: Jim Meyer Date: Thu, 3 Sep 2026 11:29:40 -0700 Subject: [PATCH 1/2] chore(codeowners): disable wildcard ownership rule The `*` rule matched every pull request and requested review from the 11-member openshell-codeowners team plus three named individuals, notifying all of them regardless of what the change touched. Comment the rule out rather than delete it so the prior ownership set stays visible while reviewers opt in manually. Ownership of `.github/VOUCHED.td` is retained so manual edits to the vouch list still require maintainer review. Signed-off-by: Jim Meyer --- .github/CODEOWNERS | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS index 4d32b414c1..46c8346d43 100644 --- a/.github/CODEOWNERS +++ b/.github/CODEOWNERS @@ -1,5 +1,9 @@ -# Broad ownership — core team reviews everything -* @NVIDIA/openshell-codeowners @mrunalp @sjenning @derekwaynecarr +# Broad ownership — disabled. This rule matched every pull request and +# requested review from the whole codeowners team plus three individuals, +# notifying all of them regardless of what the change touched. Reviewers +# opt in manually until area/topic labeling and per-area maintainer +# rosters replace it with targeted routing. Do not restore as-is. +# * @NVIDIA/openshell-codeowners @mrunalp @sjenning @derekwaynecarr # Vouch list — maintainers only (bot commits bypass, but manual edits need review) .github/VOUCHED.td @NVIDIA/openshell-codeowners From 66243cc678f9cf3e80a44f576b49ce5c90c2a013 Mon Sep 17 00:00:00 2001 From: Jim Meyer Date: Thu, 3 Sep 2026 18:16:04 -0700 Subject: [PATCH 2/2] chore(codeowners): own the approval machinery explicitly Signed-off-by: Jim Meyer --- .github/CODEOWNERS | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS index 46c8346d43..c15f2132b4 100644 --- a/.github/CODEOWNERS +++ b/.github/CODEOWNERS @@ -7,3 +7,15 @@ # Vouch list — maintainers only (bot commits bypass, but manual edits need review) .github/VOUCHED.td @NVIDIA/openshell-codeowners + +# Approval machinery — these files decide who can merge. MAINTAINERS.md is the +# approver list itself; the workflow and helper below evaluate it and publish +# "OpenShell / Core Approval". A change to any of them silently redefines who +# can approve anything, so each keeps an explicit owner after the wildcard above +# was disabled. Scoped to these paths on purpose — owning all of .github/ would +# reintroduce the fan-out this file just removed. +/MAINTAINERS.md @NVIDIA/openshell-codeowners +/.github/CODEOWNERS @NVIDIA/openshell-codeowners +/.github/workflows/core-approval.yml @NVIDIA/openshell-codeowners +/.github/zizmor.yml @NVIDIA/openshell-codeowners +/tasks/scripts/core_approval.py @NVIDIA/openshell-codeowners