[hassiebp]

What does this PR do?

Makes @hassiebp a code owner of the whole repo. Because the main protection ruleset has "Require review from Code Owners" turned on, every PR will need his approval. The one exception is PRs that only touch the Fern-generated API client in /langfuse/api/, which is what the langfuse-bot "update API spec" PRs do.

CODEOWNERS uses last-match-wins, so the rules are ordered like this:

* @hassiebp
.github/ @langfuse/maintainers @hassiebp
/langfuse/api/

• .github/ keeps @langfuse/maintainers and adds @hassiebp, so the more specific rule doesn't remove him as an owner.
• /langfuse/api/ comes last and has no owner. Today nothing owns it, because the old * @langfuse/maintainers catch-all was commented out. The new catch-all replaces that commented-out line.

Things for reviewers to check

• Self-approval: outside .github/, @hassiebp is the only code owner. GitHub doesn't let an author approve his own PR, and the ruleset has no bypass actors, so his PRs that touch anything outside .github/ and /langfuse/api/ can't be merged until a second owner is added to the * rule. This PR doesn't add anyone; that's for maintainers to decide.
• Dependabot auto-merge: uv lockfile and pyproject bumps are now owned by *. That means gh pr merge --auto in dependabot-merge.yml will wait for @hassiebp's approval instead of merging on green CI. GitHub Actions bumps touch .github/, so @hassiebp or a member of @langfuse/maintainers can approve those.
• Mixed PRs: a PR that touches /langfuse/api/ plus any other file still needs his review.

Type of change

• Tooling, CI, or repo maintenance

Verification

gh api "repos/langfuse/langfuse-python/codeowners/errors?ref=hassiebbot/codeowners-hassiebp"
# {"errors":[]}
gh api repos/langfuse/langfuse-python/rules/branches/main
# pull_request rule: require_code_owner_review=true, required_approving_review_count=0

I also checked that every file under langfuse/api/ has the "auto-generated by Fern" header, and that the five most recent langfuse-bot "update API spec" PRs (#2049, #2037, #2024, #2011, #2008) only changed files under langfuse/api/.

Checklist

• I self-reviewed the diff using code_review.md.
• I did not hand-edit generated files.
• I did not commit secrets or credentials.

  

Confidence Score: 5/5

The PR appears safe to merge with the ownership tradeoffs already acknowledged by `hassiebp`.

Summary

Updates .github/CODEOWNERS to make @hassiebp the default owner.

• Repository files now match @hassiebp, with exceptions for GitHub settings and the API client.

hassiebp explicitly acknowledged the self-approval restriction, Dependabot updates waiting for approval, and mixed PRs still requiring review. These are intentional tradeoffs in this PR.

_{Reviews (1) · Last reviewed commit: "chore: make @hassiebp a code owner excep..." · Reviewed by Greptile}

[github-actions]

@claude review

[claude]

Claude Code Review

No review was started: this request came from a bot account. Manual reviews can only be requested by someone with write access to this repository. Ask a maintainer to comment @claude review, or have your automation post the comment from a user account with write access.

_{Tip: disable this comment in your organization's Code Review settings.}

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-30T14:34:43.713960Z	a658de6	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: a658de6942

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Document the new mandatory code-owner workflow

With required code-owner review enabled, this catch-all materially changes the repository-wide PR workflow by requiring @hassiebp for every non-exempt change, but the canonical agent guide remains silent about that requirement and the /langfuse/api/ exception. Add this durable approval contract to AGENTS.md in the same change so automated contributors can plan reviews correctly.

AGENTS.md reference: AGENTS.md:L9-L12

Useful? React with 👍 / 👎.

[claude]

🔴 After merge, PRs by @ hassiebp outside .github/ and /langfuse/api/ cannot be merged, and Dependabot patch auto-merges stall. The * rule names one owner, and an author cannot approve his own PR. The PR body flags this as accepted, but nothing in the repo bypasses it. Every merge also depends on one person being available. Fix: give * at least two owners, e.g. * @ hassiebp @ langfuse/maintainers, or add a ruleset bypass actor. Keep the bare /langfuse/api/ line last so Fern PRs stay unowned.

Why this was flagged

The main protection ruleset requires code owner review, as the PR description states. * @ hassiebp at .github/CODEOWNERS:3 makes him the only owner of every path except .github/ and /langfuse/api/. GitHub does not count an author's approval of his own PR, so any PR he opens that touches e.g. langfuse/_client/ or pyproject.toml stays blocked. Dependabot uv PRs edit uv.lock/pyproject.toml, which now fall under *. So gh pr merge --auto --squash in .github/workflows/dependabot-merge.yml waits for his approval instead of merging on green CI. On the base branch only .github/ was owned by @ langfuse/maintainers, so neither path was blocked. The description calls this a matter for maintainers to decide later. But the ruleset has no bypass actors, so the block applies from the moment this merges.

Verification: .github/CODEOWNERS:3 is * @ hassiebp, which makes him the only owner of every path except .github/ (line 6) and /langfuse/api/ (line 9). GitHub does not count a PR author's own approval, so his PRs touching langfuse/_client/, pyproject.toml and so on cannot merge. On the base, # * @ langfuse/maintainers was commented out, so those PRs needed no approval.