In a monorepo, CODEOWNERS maps directories to teams so that changes need approval from the people who know that code. It works only if owners have write access, patterns are anchored correctly, and branch protection requires code owner review. GitHub's page gives no monorepo specific guidance, but the path rules cover it.
Where the file lives
GitHub looks for a CODEOWNERS file in .github/, the repository root or docs/, and uses the first one it finds in that order. Each file applies to one branch, and review requests use the file on the pull request's base branch.
Anchoring paths
A leading slash anchors a pattern to the root, so /payments/ matches that directory and everything under it. Without a leading slash, a pattern like payments/ matches a directory of that name anywhere. In a monorepo, anchoring avoids surprise matches in vendored folders.
Another detail: docs/* matches only direct children, not nested files. And the last matching pattern wins, so put general rules first and specific ones after.
Owners need write access
Individual owners need explicit write access. Team owners must be visible and have write permission. An owner who does not exist or lacks access is not assigned, which means the rule silently does nothing. Check the file for errors in the UI after each edit.
Ownerless paths
A path with no owner has no code owner, so approval can come from anyone with write access. List every top level directory in the file, including a catch-all at the top for a default team, so no path is left open.
Protect the file itself
Assign an owner to /.github/CODEOWNERS or to the /.github/ directory. Otherwise anyone who can open a pull request can propose changing who must approve it. Pair this with the setting that requires review from code owners.
Keep it under the size limit
The file must stay under 3 MB. Larger files are not loaded, and owners are not shown or requested. Use wildcard patterns to consolidate.
A starting template
* @acme/platform
/payments/ @acme/payments
/web/ @acme/frontend
/infra/ @acme/platform @acme/security
/.github/ @acme/platform
Remember that owners listed on one line all apply to that pattern, and approval from any one of them satisfies it. Use separate team handles on purpose.
Review the file whenever teams are renamed or reorganised. A team that no longer exists, or one that lost write access, quietly stops being requested, and pull requests then need approval only from anyone with write access. A short quarterly check that every listed owner still resolves is cheap. Also keep the catch-all line first, because the last matching pattern wins and a catch-all placed at the bottom would override every specific rule above it.
Quick check
Why is my code owner not requested on pull requests?
Common causes are no write access, a team that is not visible, a draft pull request, a file over 3 MB, or the file not being on the base branch.
Does CODEOWNERS stop people reading a directory?
No. It controls review requirements for changes, not read access.
Safeguard policies and gates can add automated checks on the same pull requests that CODEOWNERS routes to humans.
Sources
Last reviewed: 19 October 2026.
