Skip to content

Commit 0c54bce

Browse files
jamesmontemagnoCopilotaaronpowellCopilot
authored
Phase 1: distributed CODEOWNERS and automated reviewer routing (#4184) (#4189)
* Phase 1: distributed CODEOWNERS and automated reviewer routing (#4184) - Replace the individual default CODEOWNERS owner with the core-maintainer team and add domain team ownership for extensions, plugins, content, hooks, workflows, .github, and eng. - Add .github/review-routing.yml as the single source of truth for reviewer pools, routes, labels, and SLA settings (ships in dry-run mode). - Add eng/review-routing.mjs (+ unit tests) with business-day math, least-loaded reviewer selection, routing and escalation planning, and workflow_run artifact validation. - Add Review Routing (workflow_run/dispatch/schedule), Review Routing Request (read-only needs-reviewer reader), and Review Escalation (weekday schedule) workflows. - Add needs-reviewer, review-overdue, review-escalated to setup-labels. - Document the model in docs/maintainers/review-routing.md. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * Address review feedback on reviewer routing and escalation - Escalate at routedOn + escalation business days (Mon -> Fri) - Leave labels untouched when requestReviewers fails and fail the job - Serialize read/plan/apply per PR across routing and escalation - Treat Label PR Intent artifact labels as authoritative - Re-route to an uncovered pool on head changes without restarting SLA - Use the due-label timestamp as the review boundary - Fall back to pool/escalation teams and report what was requested Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * Address second-round review feedback on review routing (#4184) - CODEOWNERS: route /hooks/ and /workflows/ to content reviewers, drop the separate /.github/workflows/ rule, and leave per-resource owner lines as on main (their removal is deferred to a separate cleanup). - Routing: ignore pending requests for unavailable reviewers when checking coverage; needs-reviewer excludes prior reviewers and changes nothing when no new reviewer can be requested. - Escalation comments show the actual routing date. - Cap sweep matrices at 256 targets and defer the remainder. - Docs: best-effort load balancing, matrix cap, and needs-reviewer semantics. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * Route workflow and hooks labels to the content pool (#4184) Drop the workflow-security reviewer pool per maintainer feedback: agentic workflows and hooks are reviewed like other content, and the repository's own GitHub Actions workflows stay with core maintainers. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * Pin routing contract in tests; make CONTRIBUTING routing note dry-run aware - Assert the exact label-to-pool mapping and priority order, pool set, and default/escalation pools for the shipped config. - CONTRIBUTING.md: describe automatic routing as active only once dry_run is turned off. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * Simplify dry_run validation condition Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> --------- Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Co-authored-by: Aaron Powell <me@aaron-powell.com> Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
1 parent c442f0d commit 0c54bce

11 files changed

Lines changed: 2194 additions & 1 deletion

‎.github/review-routing.yml‎

Lines changed: 85 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,85 @@
1+
# Review routing configuration — single source of truth for reviewer pools.
2+
#
3+
# Read by eng/review-routing.mjs from the Review Routing and Review Escalation
4+
# workflows. See docs/maintainers/review-routing.md for the full operating model.
5+
#
6+
# Handles are GitHub logins without the leading "@". Team values use the
7+
# "<org>/<team-slug>" form. Keep every pool at three or more reviewers with
8+
# cross-time-zone coverage before turning off dry_run.
9+
10+
version: 1
11+
12+
# When true, workflows only log the actions they would take (no reviewer
13+
# requests, labels, or comments). Set to false once the teams and pools below
14+
# are populated.
15+
dry_run: true # TODO: set to false after the reviewer pools are staffed.
16+
17+
sla:
18+
# Business days (Monday–Friday, UTC, excluding holidays) after routing by
19+
# which a first review is expected. The date is shown in the review-due label.
20+
first_review_business_days: 2
21+
# Business days after routing before the PR escalates to the core pool.
22+
escalation_business_days: 4
23+
# Optional non-working days (YYYY-MM-DD, UTC) skipped by business-day math.
24+
holidays: []
25+
26+
labels:
27+
needs_reviewer: needs-reviewer
28+
due_prefix: "review-due:"
29+
overdue: review-overdue
30+
escalated: review-escalated
31+
32+
# Pool that receives escalations and acts as the last-resort fallback.
33+
escalation_pool: core-maintainers
34+
35+
# Pool used when no intent label matches a route below.
36+
default_pool: core-maintainers
37+
38+
pools:
39+
core-maintainers:
40+
team: github/awesome-copilot-core-maintainers
41+
reviewers: [] # TODO: add at least three core maintainers.
42+
backup: [] # TODO: optional; escalation already targets this pool.
43+
canvas:
44+
team: github/awesome-copilot-canvas-reviewers
45+
reviewers: [] # TODO: add at least three canvas reviewers.
46+
backup: [] # TODO: add backup reviewers for canvas extensions.
47+
plugin:
48+
team: github/awesome-copilot-plugin-reviewers
49+
reviewers: [] # TODO: add at least three plugin reviewers.
50+
backup: [] # TODO: add backup reviewers for plugins.
51+
content:
52+
team: github/awesome-copilot-content-reviewers
53+
reviewers: [] # TODO: add at least three reviewers for skills, agents, and instructions.
54+
backup: [] # TODO: add backup content reviewers.
55+
56+
# Intent labels (applied by .github/workflows/label-pr-intent*.yml) mapped to
57+
# pools. Order is priority: the first route whose label is on the PR wins.
58+
routes:
59+
- label: canvas-extension
60+
pool: canvas
61+
- label: external-plugin
62+
pool: plugin
63+
- label: plugin
64+
pool: plugin
65+
- label: skills
66+
pool: content
67+
- label: agent
68+
pool: content
69+
- label: instructions
70+
pool: content
71+
- label: workflow
72+
pool: content
73+
- label: hooks
74+
pool: content
75+
- label: website-update
76+
pool: core-maintainers
77+
78+
# Reviewers temporarily unavailable (vacation, leave). They are never selected.
79+
unavailable: []
80+
81+
# PR authors that are never routed (for example, automation accounts).
82+
skip_authors: []
83+
84+
# PRs carrying any of these labels are not routed or escalated.
85+
skip_labels: []

‎.github/workflows/review-escalation.yml‎

Lines changed: 160 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,160 @@
1+
name: Review Escalation
2+
3+
# Enforces the review SLA from .github/review-routing.yml for routed PRs
4+
# (those with a `review-due:YYYY-MM-DD` label):
5+
# - no review after the due date -> request a backup (or a team), add `review-overdue`
6+
# - no review escalation_business_days after routing -> request the
7+
# core-maintainer pool, add `review-escalated`
8+
# - first human review since routing -> clear the SLA labels
9+
# Business days skip weekends and configured holidays, so the schedule only
10+
# runs Monday–Friday.
11+
#
12+
# The read-only `plan` job selects PRs needing action; the `escalate` job then
13+
# handles each PR in the `review-routing-pr-<number>` concurrency group shared
14+
# with Review Routing. Only trusted default-branch code is executed.
15+
16+
on:
17+
schedule:
18+
- cron: "0 14 * * 1-5"
19+
workflow_dispatch:
20+
21+
permissions: {}
22+
23+
jobs:
24+
plan:
25+
runs-on: ubuntu-latest
26+
permissions:
27+
contents: read
28+
issues: read
29+
pull-requests: read
30+
outputs:
31+
targets: ${{ steps.plan.outputs.targets }}
32+
steps:
33+
- name: Checkout default branch
34+
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
35+
with:
36+
ref: ${{ github.event.repository.default_branch }}
37+
persist-credentials: false
38+
39+
- name: Setup Node.js
40+
uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
41+
with:
42+
node-version: 22
43+
cache: npm
44+
45+
- name: Install dependencies
46+
run: npm ci --ignore-scripts
47+
48+
- name: Select pull requests needing SLA action
49+
id: plan
50+
uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7.1.0
51+
with:
52+
script: |
53+
const path = require('path');
54+
const { pathToFileURL } = require('url');
55+
56+
const routing = await import(pathToFileURL(path.join(process.env.GITHUB_WORKSPACE, 'eng', 'review-routing.mjs')).href);
57+
const config = routing.loadReviewRoutingConfig(path.join(process.env.GITHUB_WORKSPACE, '.github', 'review-routing.yml'));
58+
59+
const plans = await routing.planEscalationSweep({ github, owner: context.repo.owner, repo: context.repo.repo, config });
60+
const actionable = plans.filter((plan) => ['reviewed', 'overdue', 'escalate'].includes(plan.action));
61+
62+
await core.summary.addRaw(routing.formatResultsSummary(actionable, { title: 'Review escalation plan', dryRun: config.dryRun })).write();
63+
const limited = routing.limitTargets(actionable.map((plan) => ({ pr: plan.prNumber })));
64+
if (limited.deferred > 0) core.warning(`${limited.deferred} PR(s) exceed the ${routing.MAX_MATRIX_TARGETS}-job matrix limit and are deferred to the next run.`);
65+
core.setOutput('targets', JSON.stringify(limited.targets));
66+
67+
escalate:
68+
needs: plan
69+
if: needs.plan.outputs.targets != '' && needs.plan.outputs.targets != '[]'
70+
runs-on: ubuntu-latest
71+
permissions:
72+
contents: read
73+
issues: write
74+
pull-requests: write
75+
strategy:
76+
fail-fast: false
77+
# Sequential so each PR sees reviewer load updated by the previous one.
78+
max-parallel: 1
79+
matrix:
80+
target: ${{ fromJSON(needs.plan.outputs.targets) }}
81+
concurrency:
82+
group: review-routing-pr-${{ matrix.target.pr }}
83+
cancel-in-progress: false
84+
steps:
85+
- name: Checkout default branch
86+
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
87+
with:
88+
ref: ${{ github.event.repository.default_branch }}
89+
persist-credentials: false
90+
91+
- name: Setup Node.js
92+
uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
93+
with:
94+
node-version: 22
95+
cache: npm
96+
97+
- name: Install dependencies
98+
run: npm ci --ignore-scripts
99+
100+
- name: Apply review SLA
101+
uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7.1.0
102+
env:
103+
TARGET_PR: ${{ matrix.target.pr }}
104+
with:
105+
script: |
106+
const path = require('path');
107+
const { pathToFileURL } = require('url');
108+
109+
const routing = await import(pathToFileURL(path.join(process.env.GITHUB_WORKSPACE, 'eng', 'review-routing.mjs')).href);
110+
const config = routing.loadReviewRoutingConfig(path.join(process.env.GITHUB_WORKSPACE, '.github', 'review-routing.yml'));
111+
112+
const prNumber = Number(process.env.TARGET_PR);
113+
if (!Number.isInteger(prNumber) || prNumber < 1) throw new Error(`Invalid target PR: ${process.env.TARGET_PR}`);
114+
115+
const plan = await routing.escalatePullRequest({
116+
github,
117+
owner: context.repo.owner,
118+
repo: context.repo.repo,
119+
config,
120+
prNumber,
121+
log: core,
122+
});
123+
124+
await core.summary.addRaw(routing.formatResultsSummary([plan], { title: `Review escalation for #${prNumber}`, dryRun: config.dryRun })).write();
125+
if (plan.requestError) core.setFailed(`Reviewer request failed for PR #${prNumber}: ${plan.requestError}`);
126+
127+
cleanup:
128+
needs: plan
129+
runs-on: ubuntu-latest
130+
permissions:
131+
contents: read
132+
issues: write
133+
pull-requests: read
134+
steps:
135+
- name: Checkout default branch
136+
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
137+
with:
138+
ref: ${{ github.event.repository.default_branch }}
139+
persist-credentials: false
140+
141+
- name: Setup Node.js
142+
uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
143+
with:
144+
node-version: 22
145+
cache: npm
146+
147+
- name: Install dependencies
148+
run: npm ci --ignore-scripts
149+
150+
- name: Delete stale review-due labels
151+
uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7.1.0
152+
with:
153+
script: |
154+
const path = require('path');
155+
const { pathToFileURL } = require('url');
156+
157+
const routing = await import(pathToFileURL(path.join(process.env.GITHUB_WORKSPACE, 'eng', 'review-routing.mjs')).href);
158+
const config = routing.loadReviewRoutingConfig(path.join(process.env.GITHUB_WORKSPACE, '.github', 'review-routing.yml'));
159+
const deleted = await routing.cleanupStaleDueLabels({ github, owner: context.repo.owner, repo: context.repo.repo, config, log: core });
160+
core.info(`Stale review-due labels ${config.dryRun ? 'that would be ' : ''}deleted: ${deleted.join(', ') || 'none'}`);

‎.github/workflows/review-routing-request.yml‎

Lines changed: 45 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,45 @@
1+
name: Review Routing Request
2+
3+
# Reader half of the needs-reviewer routing flow. Runs with a read-only token
4+
# and only records which PR asked for a reviewer; the privileged Review Routing
5+
# workflow validates this artifact and performs the request.
6+
#
7+
# Labels added with GITHUB_TOKEN do not emit `labeled` events, so automation
8+
# should dispatch review-routing.yml directly (or rely on its scheduled sweep).
9+
10+
on:
11+
pull_request:
12+
types: [labeled]
13+
14+
permissions:
15+
contents: read
16+
17+
jobs:
18+
capture:
19+
runs-on: ubuntu-latest
20+
if: github.event.label.name == 'needs-reviewer'
21+
steps:
22+
- name: Record routing request
23+
uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7.1.0
24+
with:
25+
script: |
26+
const fs = require('fs');
27+
const path = require('path');
28+
29+
const outDir = path.join(process.env.RUNNER_TEMP, 'review-routing-request');
30+
fs.mkdirSync(outDir, { recursive: true });
31+
fs.writeFileSync(path.join(outDir, 'result.json'), `${JSON.stringify({
32+
schema_version: 'review-routing-request/v1',
33+
event: 'pull_request',
34+
pr_number: context.payload.pull_request.number,
35+
head_sha: context.payload.pull_request.head.sha,
36+
run_id: process.env.GITHUB_RUN_ID,
37+
}, null, 2)}\n`);
38+
39+
- name: Upload routing request artifact
40+
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
41+
with:
42+
name: review-routing-request
43+
path: ${{ runner.temp }}/review-routing-request/result.json
44+
if-no-files-found: error
45+
retention-days: 3

0 commit comments

Comments
 (0)