Add a CODEOWNERS file that assigns your dependency manifests and lockfiles to the person or team that owns open source policy, then require code owner approval in branch protection. Every change that adds or upgrades a dependency is then reviewed by someone who knows the rules.
Definition
CODEOWNERS is a file that maps paths in a repository to people or teams. GitHub documents that code owners are automatically requested for review when a pull request modifies code they own, and that they are not requested for draft pull requests until the draft is marked ready. If someone with admin or owner permissions enables required reviews, they can also require approval from a code owner before merging.
Setup steps
- Create the file. Place CODEOWNERS in the .github folder, the repository root or the docs folder. If it exists in more than one, GitHub uses the first it finds in that order.
- Assign dependency files. Add lines for each manifest and lockfile pattern your repository uses, followed by the owner.
- Use a team, not a person. Teams survive vacations and departures. The owners must have explicit write access to the repository, or no owner is assigned.
- Require code owner review. In branch protection, turn on required reviews and the option requiring code owner approval.
- Test it. Open a pull request that changes a lockfile and confirm the right team is requested.
A sample layout
# Dependency manifests and lockfiles go to the open source owners
package.json @your-org/open-source-owners
package-lock.json @your-org/open-source-owners
requirements*.txt @your-org/open-source-owners
go.mod @your-org/open-source-owners
go.sum @your-org/open-source-owners
# CI and build scripts go to the platform team
.github/workflows/ @your-org/platform
Adjust the patterns to your ecosystems. Patterns follow most gitignore rules, but GitHub notes some do not work: you cannot negate with an exclamation mark, escape a leading hash, or use bracket ranges.
Pitfalls from the documentation
| Pitfall | What happens |
|---|---|
| Two owners on separate lines | Only the last one is matched. Put several owners on the same line |
| Owner lacks write access | No code owner is assigned |
| Invalid syntax on a line | That line is skipped, so check the error highlighting |
| File over 3 MB | It is not loaded at all |
| CODEOWNERS only on a feature branch | Review requests use the version on the base branch of the pull request |
| Paths with wrong case | Matching is case sensitive |
What this does and does not give you
It routes review. It does not decide whether a dependency is acceptable. Reviewers still need criteria, such as the allowed license list and a health check. See a checklist before adding a new open source dependency. Pair human review with automated checks so reviewers spend time on judgment, not lookups.
Scaling by team size
- Small team: one owner team for all dependency files.
- Mid size: one owner team per ecosystem or per service, plus a security reviewer for new packages.
- Large organization: default owners at the organization level, with local owners per repository and a central group only for policy files.
Where Safeguard fits
CODEOWNERS routes the pull request. Safeguard's policies, gates and guardrails can check the same change automatically, for example blocking a component from a not allowed list, and its dependency scanning shows what the change adds. A free scan is available at gold.safeguard.sh/scan.
Try it yourself
Click through it at your own pace, or open it full screen. Look at what a reviewer sees on a dependency change.
Quick check
Does CODEOWNERS block merges by itself?
Only if required reviews and code owner approval are enabled in branch protection. Otherwise it just requests reviews.
Are code owners requested on draft pull requests?
No. They are notified when the draft is marked ready for review.
Sources
Last reviewed: 19 October 2026.
