Skip to content

CODEOWNERS policy: also drop .github/workflows/ line on solo-owned repos to silence Dependabot github-actions PRs #55

@hyperpolymath

Description

@hyperpolymath

Context

On 2026-05-14, opened 18 PRs across hyperpolymath/* repos dropping the catch-all * @hyperpolymath line from CODEOWNERS to stop Dependabot PRs auto-requesting review (the root cause of the recurring reason:review_requested notification flood). Those PRs cover the cargo/mix/nix/npm dependency ecosystems.

PRs opened:

  • gitbot-fleet#125, hypatia#238, reasonably-good-token-vault#49, boj-server#61, bofig#59, idaptik#81, protocol-squisher#53, proof-of-work#48, InvestigativeJournalist.jl#7, TradeUnionist.jl#7, echidna#58, coq-jr#13, cloudguard-server#7, cloudguard-cli#6, ambientops#36, snifs#7, somethings-fishy#7, affinescript-vite#11

Remaining: github-actions ecosystem

15 of the 18 repos still have a .github/workflows/ path line in CODEOWNERS. Dependabot's github-actions ecosystem PRs (which bump action versions by editing workflow files) will continue to trigger review requests on these.

Repo Line Owner(s)
gitbot-fleet /.github/workflows/ @hyperpolymath
hypatia /.github/workflows/ @hyperpolymath
boj-server .github/workflows/ @hyperpolymath
bofig /.github/workflows/ @hyperpolymath
idaptik .github/workflows/ @JoshuaJewell @hyperpolymath
proof-of-work /.github/workflows/ @hyperpolymath
InvestigativeJournalist.jl .github/workflows/ @hyperpolymath
TradeUnionist.jl .github/workflows/ @hyperpolymath
echidna /.github/workflows/ @hyperpolymath
coq-jr /.github/workflows/ @hyperpolymath
cloudguard-server .github/workflows/ @hyperpolymath
cloudguard-cli .github/workflows/ @hyperpolymath
snifs .github/workflows/ @hyperpolymath
somethings-fishy .github/workflows/ @hyperpolymath
affinescript-vite .github/workflows/ @hyperpolymath

Decision needed

For each repo, pick:

  • (a) Drop the workflow line — fully silences Dependabot github-actions PRs. Sensible for solo-owned repos where the line provides no functional gating.
  • (b) Keep it — workflows changes still gate on code-owner review, accepting Dependabot ping-noise as the price.
  • idaptik specifically: has @JoshuaJewell as co-owner. Dropping the line would also remove their auto-review on workflow changes — needs explicit confirmation.

Suggested standard

For solo-owned hyperpolymath/* repos, drop both * and /.github/workflows/ CODEOWNERS lines. Keep neither for security gating (sole-maintainer review is moot) nor attribution (SPDX header in the file already covers that). Path-specific lines are only useful when there's another collaborator who should be auto-pinged.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions