Check the base branch’s CODEOWNERS file before relying on requested reviews

Ownership rules are read from the pull request’s destination branch, with a defined file-location search order.

Source facts

GitHub looks for CODEOWNERS in .github, the repository root and docs, using the first file found in that order. Pull-request review requests use the base branch’s version of that file. Owners must have the required write access, including an explicitly authorized visible team. Invalid lines are skipped, and merely listing owners is separate from enabling required owner approval.

Source: GitHub — About code owners.

Applicability

This concerns GitHub code-owner selection and review requests. It does not prove that every file has an owner or that a requested review is a mandatory merge gate.

DSE recommendation

DSE recommends testing ownership rules on the branch they are intended to protect. Review duplicate CODEOWNERS locations, case-sensitive patterns and the access of named teams. Protect the ownership file itself through the intended review controls. Keep notification routing separate from required approvals in the repository checklist, with a clear owner for maintaining both after team changes. Maintain a small set of representative file paths and expected owners as review examples. Repeat the check when a team is renamed or access changes, and require an explicit merge-protection review for the ownership file itself and the branches it is meant to govern.

Verification

Proposed verification: open harmless test changes for representative paths and inspect the requested owners. Check the CODEOWNERS error display and compare the selected file with the base branch. Exercise the intended merge gate in a test branch, recording both the requested reviewer and whether an unapproved change remains blocked.

Official reference

GitHub — About code owners. Reviewed October 20, 2026.