Repository has a CODEOWNERS file

Check ID: repository_has_codeowners_file
Provider: GitHub
Service: repository
Severity: MEDIUM
Categories: software-supply-chain
Resource type: NotDefined

What this check verifies

GitHub repositories declare code ownership via a CODEOWNERS file mapping file patterns to users or teams. This evaluation checks whether such a file exists in standard locations (/, .github/, or docs/) to enable automatic reviewer assignment.

Risk

Missing CODEOWNERS undermines integrity and separation of duties:

PRs can merge without accountable, domain reviews
Critical paths risk unauthorized or low-quality changes This raises software supply chain exposure, enabling code tampering, hidden backdoors, and unsafe config modifications.

Recommendation

Define and maintain a CODEOWNERS file mapping sensitive paths to responsible teams or users, preferring teams for resilience. Combine with branch protections requiring code-owner reviews to enforce separation of duties and least privilege. Keep entries current and cover critical directories to avoid pattern gaps.

Remediation

CLI
Terraform
Dashboard steps

gh api -X PUT repos/<example_org_or_user>/<example_repo>/contents/.github/CODEOWNERS -f message='add CODEOWNERS' -f content="$(printf '* @<example_owner>\n' | base64 | tr -d '\n')"

resource "github_repository_file" "<example_resource_name>" {
  repository = "<example_repo>"
  file       = ".github/CODEOWNERS"  # Critical: creates the CODEOWNERS file so the check passes
  content    = "* @<example_owner>"   # Critical: minimal valid content so the file is recognized
}

In GitHub, open the target repository
Click Add file > Create new file
Set the filename to .github/CODEOWNERS
Add a single line: * @<example_owner>
Click Commit new file (commit to the default branch)

References

Where this check fires

This check runs on every scheduled scan against your GitHub account. Findings appear at Cloud Security → Findings filterable by Check ID = repository_has_codeowners_file. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to GitHub checks

Repository has Dependabot vulnerability alerts enabled Repository has immutable releases enabled

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires