{
    "api_version": "1",
    "kind": "dse_post",
    "self": "https://update.dsesecurity.com/api/v1/posts/github-codeowners-base-branch-file-selection/",
    "item": {
        "id": "https://update.dsesecurity.com/updates/github-codeowners-base-branch-file-selection/",
        "slug": "github-codeowners-base-branch-file-selection",
        "url": "https://update.dsesecurity.com/updates/github-codeowners-base-branch-file-selection/",
        "alternate_urls": {
            "markdown": "https://update.dsesecurity.com/updates/github-codeowners-base-branch-file-selection.md",
            "json": "https://update.dsesecurity.com/api/v1/posts/github-codeowners-base-branch-file-selection/"
        },
        "title": "Check the base branch’s CODEOWNERS file before relying on requested reviews",
        "summary": "Ownership rules are read from the pull request’s destination branch, with a defined file-location search order.",
        "format": {
            "slug": "guide",
            "name": "Guide"
        },
        "priority": {
            "slug": "info",
            "name": "Information"
        },
        "featured": false,
        "image": {
            "theme": "cyber-defense",
            "label": "Cyber defense",
            "alt": "Layered glass and metal cyber-defense structure with controlled blue and gold signal paths.",
            "card_url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-card.webp?v=1.8.20",
            "hero_url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-hero.webp?v=1.8.20",
            "social_url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-social-v2.jpg?v=1.8.20",
            "width": 2400,
            "height": 1350
        },
        "topics": [
            {
                "slug": "cybersecurity",
                "name": "Cybersecurity",
                "url": "https://update.dsesecurity.com/topic/cybersecurity/"
            },
            {
                "slug": "it",
                "name": "IT",
                "url": "https://update.dsesecurity.com/topic/it/"
            }
        ],
        "author": {
            "name": "DSE Security Editorial Team",
            "url": "https://update.dsesecurity.com/#editorial-team",
            "type": "Organization"
        },
        "publisher": {
            "name": "Detection Systems & Engineering",
            "url": "https://dsesecurity.com/"
        },
        "published_at": "2026-10-20T18:14:27+00:00",
        "modified_at": "2026-10-20T18:34:31+00:00",
        "reviewed_on": "2026-10-20",
        "reading_minutes": 2,
        "word_count": 272,
        "potentially_affected": "This concerns GitHub code-owner selection and review requests. It does not prove that every file has an owner or that a requested review is a mandatory merge gate.",
        "dse_recommendation": "DSE recommends testing ownership rules on the branch they are intended to protect.",
        "primary_source": {
            "name": "GitHub — About code owners",
            "url": "https://docs.github.com/en/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/about-code-owners",
            "published_on": null,
            "authority": "docs.github.com"
        },
        "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/",
        "usage_info": "https://update.dsesecurity.com/usage/",
        "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.",
        "content_html": "<p>Ownership rules are read from the pull request’s destination branch, with a defined file-location search order.</p>\n<h2>Source facts</h2>\n<p>GitHub looks for CODEOWNERS in .github, the repository root and docs, using the first file found in that order. Pull-request review requests use the base branch’s version of that file. Owners must have the required write access, including an explicitly authorized visible team. Invalid lines are skipped, and merely listing owners is separate from enabling required owner approval.</p>\n<p>Source: <a href=\"https://docs.github.com/en/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/about-code-owners\">GitHub — About code owners</a>.</p>\n<h2>Applicability</h2>\n<p>This concerns GitHub code-owner selection and review requests. It does not prove that every file has an owner or that a requested review is a mandatory merge gate.</p>\n<h2>DSE recommendation</h2>\n<p>DSE recommends testing ownership rules on the branch they are intended to protect. Review duplicate CODEOWNERS locations, case-sensitive patterns and the access of named teams. Protect the ownership file itself through the intended review controls. Keep notification routing separate from required approvals in the repository checklist, with a clear owner for maintaining both after team changes. Maintain a small set of representative file paths and expected owners as review examples. Repeat the check when a team is renamed or access changes, and require an explicit merge-protection review for the ownership file itself and the branches it is meant to govern.</p>\n<h2>Verification</h2>\n<p>Proposed verification: open harmless test changes for representative paths and inspect the requested owners. Check the CODEOWNERS error display and compare the selected file with the base branch. Exercise the intended merge gate in a test branch, recording both the requested reviewer and whether an unapproved change remains blocked.</p>\n<h2>Official reference</h2>\n<p><a href=\"https://docs.github.com/en/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/about-code-owners\">GitHub — About code owners</a>. Reviewed October 20, 2026.</p>",
        "content_text": "Ownership rules are read from the pull request’s destination branch, with a defined file-location search order.\nSource facts\nGitHub looks for CODEOWNERS in .github, the repository root and docs, using the first file found in that order. Pull-request review requests use the base branch’s version of that file. Owners must have the required write access, including an explicitly authorized visible team. Invalid lines are skipped, and merely listing owners is separate from enabling required owner approval.\nSource: GitHub — About code owners.\nApplicability\nThis concerns GitHub code-owner selection and review requests. It does not prove that every file has an owner or that a requested review is a mandatory merge gate.\nDSE recommendation\nDSE recommends testing ownership rules on the branch they are intended to protect. Review duplicate CODEOWNERS locations, case-sensitive patterns and the access of named teams. Protect the ownership file itself through the intended review controls. Keep notification routing separate from required approvals in the repository checklist, with a clear owner for maintaining both after team changes. Maintain a small set of representative file paths and expected owners as review examples. Repeat the check when a team is renamed or access changes, and require an explicit merge-protection review for the ownership file itself and the branches it is meant to govern.\nVerification\nProposed verification: open harmless test changes for representative paths and inspect the requested owners. Check the CODEOWNERS error display and compare the selected file with the base branch. Exercise the intended merge gate in a test branch, recording both the requested reviewer and whether an unapproved change remains blocked.\nOfficial reference\nGitHub — About code owners. Reviewed October 20, 2026.",
        "content_markdown": "Ownership rules are read from the pull request’s destination branch, with a defined file-location search order.\n\n## Source facts\n\nGitHub looks for CODEOWNERS in .github, the repository root and docs, using the first file found in that order. Pull-request review requests use the base branch’s version of that file. Owners must have the required write access, including an explicitly authorized visible team. Invalid lines are skipped, and merely listing owners is separate from enabling required owner approval.\n\nSource: [GitHub — About code owners](https://docs.github.com/en/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/about-code-owners).\n\n## Applicability\n\nThis concerns GitHub code-owner selection and review requests. It does not prove that every file has an owner or that a requested review is a mandatory merge gate.\n\n## DSE recommendation\n\nDSE recommends testing ownership rules on the branch they are intended to protect. Review duplicate CODEOWNERS locations, case-sensitive patterns and the access of named teams. Protect the ownership file itself through the intended review controls. Keep notification routing separate from required approvals in the repository checklist, with a clear owner for maintaining both after team changes. Maintain a small set of representative file paths and expected owners as review examples. Repeat the check when a team is renamed or access changes, and require an explicit merge-protection review for the ownership file itself and the branches it is meant to govern.\n\n## Verification\n\nProposed verification: open harmless test changes for representative paths and inspect the requested owners. Check the CODEOWNERS error display and compare the selected file with the base branch. Exercise the intended merge gate in a test branch, recording both the requested reviewer and whether an unapproved change remains blocked.\n\n## Official reference\n\n[GitHub — About code owners](https://docs.github.com/en/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/about-code-owners). Reviewed October 20, 2026."
    },
    "json_ld": {
        "@context": "https://schema.org",
        "@graph": [
            {
                "@type": "Organization",
                "@id": "https://dsesecurity.com/#organization",
                "name": "Detection Systems & Engineering",
                "alternateName": "DSE Security",
                "url": "https://dsesecurity.com/",
                "logo": {
                    "@type": "ImageObject",
                    "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20"
                }
            },
            {
                "@type": "Organization",
                "@id": "https://update.dsesecurity.com/#editorial-team",
                "name": "DSE Security Editorial Team",
                "url": "https://update.dsesecurity.com/",
                "parentOrganization": {
                    "@id": "https://dsesecurity.com/#organization"
                }
            },
            {
                "@type": "WebSite",
                "@id": "https://update.dsesecurity.com/#website",
                "name": "DSE Updates",
                "alternateName": "DSE Security Knowledge Hub",
                "url": "https://update.dsesecurity.com/",
                "inLanguage": "en-US",
                "publisher": {
                    "@id": "https://dsesecurity.com/#organization"
                },
                "potentialAction": {
                    "@type": "SearchAction",
                    "target": {
                        "@type": "EntryPoint",
                        "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}"
                    },
                    "query-input": "required name=search_term_string"
                }
            },
            {
                "@type": "WebPage",
                "@id": "https://update.dsesecurity.com/updates/github-codeowners-base-branch-file-selection/",
                "url": "https://update.dsesecurity.com/updates/github-codeowners-base-branch-file-selection/",
                "isPartOf": {
                    "@id": "https://update.dsesecurity.com/#website"
                },
                "lastReviewed": "2026-10-20"
            },
            {
                "@type": "BreadcrumbList",
                "@id": "https://update.dsesecurity.com/updates/github-codeowners-base-branch-file-selection/#breadcrumbs",
                "itemListElement": [
                    {
                        "@type": "ListItem",
                        "position": 1,
                        "name": "DSE Updates",
                        "item": "https://update.dsesecurity.com/"
                    },
                    {
                        "@type": "ListItem",
                        "position": 2,
                        "name": "Cybersecurity",
                        "item": "https://update.dsesecurity.com/topic/cybersecurity/"
                    },
                    {
                        "@type": "ListItem",
                        "position": 3,
                        "name": "Check the base branch’s CODEOWNERS file before relying on requested reviews",
                        "item": "https://update.dsesecurity.com/updates/github-codeowners-base-branch-file-selection/"
                    }
                ]
            },
            {
                "@type": [
                    "Article",
                    "TechArticle"
                ],
                "@id": "https://update.dsesecurity.com/updates/github-codeowners-base-branch-file-selection/#article",
                "identifier": "https://update.dsesecurity.com/updates/github-codeowners-base-branch-file-selection/",
                "url": "https://update.dsesecurity.com/updates/github-codeowners-base-branch-file-selection/",
                "headline": "Check the base branch’s CODEOWNERS file before relying on requested reviews",
                "description": "Ownership rules are read from the pull request’s destination branch, with a defined file-location search order.",
                "abstract": "Ownership rules are read from the pull request’s destination branch, with a defined file-location search order.",
                "articleBody": "Ownership rules are read from the pull request’s destination branch, with a defined file-location search order.\nSource facts\nGitHub looks for CODEOWNERS in .github, the repository root and docs, using the first file found in that order. Pull-request review requests use the base branch’s version of that file. Owners must have the required write access, including an explicitly authorized visible team. Invalid lines are skipped, and merely listing owners is separate from enabling required owner approval.\nSource: GitHub — About code owners.\nApplicability\nThis concerns GitHub code-owner selection and review requests. It does not prove that every file has an owner or that a requested review is a mandatory merge gate.\nDSE recommendation\nDSE recommends testing ownership rules on the branch they are intended to protect. Review duplicate CODEOWNERS locations, case-sensitive patterns and the access of named teams. Protect the ownership file itself through the intended review controls. Keep notification routing separate from required approvals in the repository checklist, with a clear owner for maintaining both after team changes. Maintain a small set of representative file paths and expected owners as review examples. Repeat the check when a team is renamed or access changes, and require an explicit merge-protection review for the ownership file itself and the branches it is meant to govern.\nVerification\nProposed verification: open harmless test changes for representative paths and inspect the requested owners. Check the CODEOWNERS error display and compare the selected file with the base branch. Exercise the intended merge gate in a test branch, recording both the requested reviewer and whether an unapproved change remains blocked.\nOfficial reference\nGitHub — About code owners. Reviewed October 20, 2026.",
                "datePublished": "2026-10-20T18:14:27+00:00",
                "dateModified": "2026-10-20T18:34:31+00:00",
                "mainEntityOfPage": {
                    "@id": "https://update.dsesecurity.com/updates/github-codeowners-base-branch-file-selection/"
                },
                "inLanguage": "en-US",
                "isAccessibleForFree": true,
                "author": {
                    "@type": "Organization",
                    "name": "DSE Security Editorial Team",
                    "url": "https://update.dsesecurity.com/#editorial-team"
                },
                "publisher": {
                    "@id": "https://dsesecurity.com/#organization"
                },
                "image": {
                    "@type": "ImageObject",
                    "@id": "https://update.dsesecurity.com/updates/github-codeowners-base-branch-file-selection/#primaryimage",
                    "url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-social-v2.jpg?v=1.8.20",
                    "contentUrl": "https://update.dsesecurity.com/assets/editorial/cyber-defense-social-v2.jpg?v=1.8.20",
                    "width": 1200,
                    "height": 630,
                    "caption": "Check the base branch’s CODEOWNERS file before relying on requested reviews"
                },
                "articleSection": [
                    "Cybersecurity",
                    "IT"
                ],
                "keywords": [
                    "Cybersecurity",
                    "IT",
                    "Guide",
                    "Information priority"
                ],
                "genre": "Guide",
                "about": [
                    {
                        "@type": "Thing",
                        "name": "Cybersecurity",
                        "url": "https://update.dsesecurity.com/topic/cybersecurity/"
                    },
                    {
                        "@type": "Thing",
                        "name": "IT",
                        "url": "https://update.dsesecurity.com/topic/it/"
                    }
                ],
                "wordCount": 272,
                "timeRequired": "PT2M",
                "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/",
                "usageInfo": "https://update.dsesecurity.com/usage/",
                "copyrightHolder": {
                    "@id": "https://dsesecurity.com/#organization"
                },
                "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.",
                "citation": {
                    "@type": "CreativeWork",
                    "name": "GitHub — About code owners",
                    "url": "https://docs.github.com/en/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/about-code-owners"
                }
            }
        ]
    }
}