Skip to content
Open
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 7 additions & 3 deletions .github/CODEOWNERS
Original file line number Diff line number Diff line change
@@ -1,5 +1,9 @@
# Currently inactive
# * @langfuse/maintainers
# Order matters: the last matching pattern wins.

* @hassiebp

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 Badge Document the new mandatory code-owner workflow

With required code-owner review enabled, this catch-all materially changes the repository-wide PR workflow by requiring @hassiebp for every non-exempt change, but the canonical agent guide remains silent about that requirement and the /langfuse/api/ exception. Add this durable approval contract to AGENTS.md in the same change so automated contributors can plan reviews correctly.

AGENTS.md reference: AGENTS.md:L9-L12

Useful? React with 👍 / 👎.

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔴 After merge, PRs by @ hassiebp outside .github/ and /langfuse/api/ cannot be merged, and Dependabot patch auto-merges stall. The * rule names one owner, and an author cannot approve his own PR. The PR body flags this as accepted, but nothing in the repo bypasses it. Every merge also depends on one person being available. Fix: give * at least two owners, e.g. * @ hassiebp @ langfuse/maintainers, or add a ruleset bypass actor. Keep the bare /langfuse/api/ line last so Fern PRs stay unowned.

Why this was flagged

The main protection ruleset requires code owner review, as the PR description states. * @ hassiebp at .github/CODEOWNERS:3 makes him the only owner of every path except .github/ and /langfuse/api/. GitHub does not count an author's approval of his own PR, so any PR he opens that touches e.g. langfuse/_client/ or pyproject.toml stays blocked. Dependabot uv PRs edit uv.lock/pyproject.toml, which now fall under *. So gh pr merge --auto --squash in .github/workflows/dependabot-merge.yml waits for his approval instead of merging on green CI. On the base branch only .github/ was owned by @ langfuse/maintainers, so neither path was blocked. The description calls this a matter for maintainers to decide later. But the ruleset has no bypass actors, so the block applies from the moment this merges.

Verification: .github/CODEOWNERS:3 is * @ hassiebp, which makes him the only owner of every path except .github/ (line 6) and /langfuse/api/ (line 9). GitHub does not count a PR author's own approval, so his PRs touching langfuse/_client/, pyproject.toml and so on cannot merge. On the base, # * @ langfuse/maintainers was commented out, so those PRs needed no approval.


# Require maintainer review for GitHub configuration changes
.github/ @langfuse/maintainers
.github/ @langfuse/maintainers @hassiebp

# Fern-generated API client: no owner, so Fern upgrades do not need code owner review
/langfuse/api/
Loading