Remove invalid CODEOWNERS configuration by PureWeen · Pull Request #36890 · dotnet/maui

PureWeen · 2026-07-28T18:18:39Z

Description of Change

Removes .github/CODEOWNERS, whose only entry is currently invalid:

* @dotnet/dotnet-maui-reviewers

GitHub's CODEOWNERS errors API reports this owner as unknown because the team has Read access to dotnet/maui (pull: true, push: false). GitHub requires teams named in CODEOWNERS to have explicit Write access, so the line is ignored today.

This does not remove an effective review gate:

MAUI protection independently continues to require one approving review.
Its require_code_owner_review setting has no matching valid code owner today, so removing the rejected file preserves the current effective behavior.
There is no fallback CODEOWNERS file elsewhere in the repository.
No repository automation reads this file; the only text references are generic content embedded in generated workflow lock files.

The entry was introduced in #16682 on August 10, 2023 to auto-request the MAUI reviewers team. Repository team permissions are not stored in git, so it is not possible to determine from public history whether the team had Write access then and lost it later, or whether the entry was invalid from the start.

Removing it makes the repository configuration accurately reflect its current behavior and prevents a future team-permission change from unexpectedly activating code-owner enforcement and blocking automation.

A separate repository-settings cleanup can turn off the currently ineffective Require review from Code Owners checkbox. That settings change is intentionally not represented as code in this PR.

Related context: #36875

Issues Fixed

None; repository policy cleanup.

GitHub rejects the only owner in this file because dotnet-maui-reviewers has Read, not Write, access to this repository. The line is therefore ignored and the code-owner requirement is already ineffective. Remove the misleading file so repository policy reflects its actual behavior; the independent one-approval ruleset remains unchanged.

github-actions · 2026-07-28T18:18:48Z

🚀 Dogfood this PR with:

⚠️ WARNING: Do not do this without first carefully reviewing the code of this PR to satisfy yourself it is safe.

curl -fsSL https://raw.githubusercontent.com/dotnet/maui/main/eng/scripts/get-maui-pr.sh | bash -s -- 36890

Or

Run remotely in PowerShell:

iex "& { $(irm https://raw.githubusercontent.com/dotnet/maui/main/eng/scripts/get-maui-pr.ps1) } 36890"

azure-pipelines · 2026-07-28T18:18:50Z

Azure Pipelines: 1 pipeline(s) were filtered out due to trigger conditions. There may be pipelines that require an authorized user to comment /azp run to run.

Copilot

Pull request overview

This PR removes the repository’s .github/CODEOWNERS file, which previously contained a single (reportedly invalid) owner entry and therefore did not provide an effective code-owner review gate.

Changes:

Delete .github/CODEOWNERS to avoid carrying an invalid/ignored CODEOWNERS configuration.
Eliminate the risk that a future permission change for @dotnet/dotnet-maui-reviewers unexpectedly activates code-owner enforcement.

Show a summary per file

File	Description
`.github/CODEOWNERS`	Removed the only CODEOWNERS entry, leaving no CODEOWNERS file in the repo.

Copilot's findings

Files reviewed: 1/1 changed files
Comments generated: 0

PureWeen · 2026-07-28T18:47:14Z

Closing because we are keeping CODEOWNERS for reviewer auto-requesting and will make the existing team entry valid by granting the team Write access. Code-owner approval remains disabled in the ruleset, so this does not become a merge requirement.

kubaflo

✅ LGTM. Verified the "invalid" claim against GitHub's own CODEOWNERS validation:

GET /repos/dotnet/maui/codeowners/errors
→ line 1: "Unknown owner" — @dotnet/dotnet-maui-reviewers (team exists but is not
  publicly visible / lacks write access on this repo)

So the single * @dotnet/dotnet-maui-reviewers rule is non-functional today — GitHub rejects the owner, so it already assigns no reviewers. Deleting the file is a clean behavioral no-op that clears the persistent CODEOWNERS error. license/cla passes; maui-pr is skipping (path-filtered — .github config only), which is expected.

(If default code-owner review is ever wanted back, the alternative would be making the team publicly visible + granting it write access — but that's a separate call; removing the invalid rule as-is loses no working behavior.)

_{🤖 AI-assisted review — verified via the GitHub CODEOWNERS errors API. Trivial config removal; not a maintainer approval.}

PureWeen · 2026-07-28T21:32:49Z

Reopening after confirming MAUI does not need CODEOWNERS for reviewer routing and no visible dotnet organization policy requires the file. Require review from Code Owners is now disabled in MAUI protection; the independent one-approval rule remains. Removing this invalid file therefore matches the intended policy and does not affect auto-merge.

azure-pipelines · 2026-07-28T21:32:56Z

Azure Pipelines: 1 pipeline(s) were filtered out due to trigger conditions. There may be pipelines that require an authorized user to comment /azp run to run.

> [!NOTE] > Are you waiting for the changes in this PR to be merged? > It would be very helpful if you could [test the resulting artifacts](https://github.com/dotnet/maui/wiki/Testing-PR-Builds) from this PR and let us know in a comment if this change resolves your issue. Thank you! ### Description of Change Auto-approve and enable GitHub native auto-merge for immutable snapshots of these exact forward-merge targets: ```text main => net11.0 net11.0 => release/11.0.1xx-preview7 net11.0 => release/11.0.1xx-rc1 net11.0 => release/11.0.1xx-rc2 ``` ### Immutable snapshot design Each caller workflow checks for its generated merge PR before invoking Arcade: ```text no open merge PR -> run Arcade and create a fresh snapshot open merge PR -> leave its branch unchanged while CI runs ``` The checks use exact head/base pairs and require the PR authoring App to be `github-actions` with `isCrossRepository == false`. The release workflow resolves the current `MergeToBranch` from `github-merge-flow-release-11.jsonc` on `net11.0`, and passes `configuration_file_branch: net11.0` to Arcade so the gate and merge implementation use the same source of truth. Workflow runs are serialized with distinct concurrency groups so simultaneous push/schedule/manual runs cannot both pass the check and create or update the same PR. Because scheduled workflows start from the default branch, the release schedule uses a schedule-only job to dispatch `merge-net11-to-release.yml` at ref `net11.0`; the dispatched run is not a schedule event and cannot recurse. During rollout, the schedule job first compares the parsed safety-critical sections (`concurrency`, `CheckForOpenMergePullRequest`, and `Merge`) between the workflow on `main` and `net11.0`. It skips the dispatch until the full immutable-snapshot gate has propagated, while allowing unrelated branch-specific workflow differences. Fetch or parse failures fail visibly instead of dispatching an unknown definition. The read-only snapshot checks use read-only `GITHUB_TOKEN` permissions. Only the reusable Arcade merge job retains content and pull-request write access. New source commits that arrive while a merge PR is open wait for the next generated PR. Once the current PR merges or closes, the next push or daily schedule creates a fresh snapshot containing the remaining commits. This intentionally stops using Arcade's existing "fast-forward the open merge PR" behavior. The generated PR head does not change during CI, so source-branch pushes do not invalidate its approval or restart CI. ### Policy Service rule The rule runs only on `Opened`; `Synchronize` is not accepted. It requires: - event sender `github-actions[bot]` - event sender is also the PR author - exact target branch - exact, fully anchored generated title Human conflict-resolution pushes do not trigger reapproval. Bot-attributed `/rebase` synchronization also does not trigger the policy, closing the review-bypass path identified in the adversarial review. ### Review behavior and accepted limitation `MAUI protection` intentionally remains: ```text dismiss_stale_reviews_on_push: true require_last_push_approval: false required_approving_review_count: 1 ``` This preserves the repository's human-review workflow: a maintainer who pushes a fix to another person's PR can provide the subsequent approval without requiring a third reviewer. This PR does not modify repository rulesets or add a bypass. The generated merge PR remains safe under these settings. Policy Service approves only the initial `Opened` snapshot, the caller workflow refuses to invoke Arcade while the exact bot-authored PR remains open, and any out-of-band head push dismisses the approval with no automatic reapproval path. Ordinary target-branch advancement does not require the generated PR to update because the required status-check rules use `strict_required_status_checks_policy: false`. If the immutable head remains conflict-free, its approval remains valid, and required checks pass, auto-merge can complete against the advanced base. In the narrower case where base activity actually changes the reviewed diff or merge base, GitHub can dismiss the approval and safely stall the PR. That fail-closed limitation is accepted for this automation. ### Exact branch and title allow-list ```text net11.0 + ^[automated] Merge branch 'main' => 'net11.0'$ release/...-preview7 + ^[automated] Merge branch 'net11.0' => 'release/...-preview7'$ release/...-rc1 + ^[automated] Merge branch 'net11.0' => 'release/...-rc1'$ release/...-rc2 + ^[automated] Merge branch 'net11.0' => 'release/...-rc2'$ ``` Each entry in the file contains the full literal branch and anchored regex. Targets outside this allow-list remain manual. ### Merge behavior ```yaml - enableAutoMerge: mergeMethod: merge ``` This always creates a true merge commit, never squash or rebase. Arcade relies on merge ancestry to determine what remains to flow. GitHub completes auto-merge only when the PR has no merge conflict and required checks pass. ### Required checks | ruleset | checks | Policy Service bypass | | --- | --- | --- | | `MAUI required CI checks` | `maui-pr` | **none** | | `MAUI device and UI test checks` | `maui-pr-devicetests`, `maui-pr-uitests` | pull requests only | A failing or pending `maui-pr` blocks the merge. Device/UI checks do not. `MAUI protection` has no Policy Service bypass. It requires one ordinary approval; Policy Service supplies it for the exact authenticated `Opened` events above. ### CODEOWNERS PR #36890 removes the invalid CODEOWNERS file. `Require review from Code Owners` is disabled in `MAUI protection`; the ordinary one-approval requirement remains. ### Accepted trust boundary An initial `Opened` event authorizes on exact title/base plus `github-actions[bot]` as both sender and PR author. A collaborator with repository push access could deliberately create a same-repository workflow and matching PR. Real `maui-pr` from Azure Pipelines integration 9426 must still pass, but there is no additional human review under the intentionally ordinary one-review policy. This tradeoff is accepted for these exact forward-merge target pairs. The immutable-snapshot gate prevents later human content from being reapproved through synchronization. No new App is installed and no bypass is added to `MAUI protection` or the `maui-pr` ruleset. ### Verification - Both caller workflows pass `actionlint`. - All three changed YAML files parse successfully. - The live target resolver returns `release/11.0.1xx-preview7`. - Exact App/head/base/same-repository queries identify #36886 (`main => net11.0`) and #36880 (`net11.0 => release/11.0.1xx-preview7`). - The semantic rollout check rejects the current old `net11.0` workflow and accepts matching safety-critical sections. - Official GitHub documentation confirms that `workflow_dispatch` events created with `GITHUB_TOKEN` start workflow runs; the dispatched event skips the schedule-only job. - The Policy Service file parses and GitOps schema validation runs on every update. - The live `MAUI protection` settings and effective non-strict required-status-check rules were reverified on 2026-07-31. ### Issues Fixed None; infrastructure automation. --------- Co-authored-by: PureWeen <223556219+Copilot@users.noreply.github.com> Copilot-Session: 1b2b2dd6-bf5f-4179-8a8f-c4c85b9bce26

Copilot AI review requested due to automatic review settings July 28, 2026 18:18

PureWeen temporarily deployed to copilot-pat-pool July 28, 2026 18:18 — with GitHub Actions Inactive

Copilot started reviewing on behalf of PureWeen July 28, 2026 18:19 View session

PureWeen temporarily deployed to copilot-pat-pool July 28, 2026 18:19 — with GitHub Actions Inactive

PureWeen temporarily deployed to copilot-pat-pool July 28, 2026 18:20 — with GitHub Actions Inactive

PureWeen temporarily deployed to copilot-pat-pool July 28, 2026 18:22 — with GitHub Actions Inactive

PureWeen temporarily deployed to copilot-pat-pool July 28, 2026 18:23 — with GitHub Actions Inactive

github-actions Bot added the area-infrastructure CI, Maestro / Coherency, upstream dependencies/versions label Jul 28, 2026

PureWeen temporarily deployed to copilot-pat-pool July 28, 2026 18:23 — with GitHub Actions Inactive

Copilot AI reviewed Jul 28, 2026

View reviewed changes

PureWeen mentioned this pull request Jul 28, 2026

Auto-merge clean inter-branch forward merges #36875

Merged

PureWeen closed this Jul 28, 2026

kubaflo approved these changes Jul 28, 2026

View reviewed changes

PureWeen reopened this Jul 28, 2026

PureWeen temporarily deployed to copilot-pat-pool July 28, 2026 21:32 — with GitHub Actions Inactive

PureWeen temporarily deployed to copilot-pat-pool July 28, 2026 21:33 — with GitHub Actions Inactive

PureWeen temporarily deployed to copilot-pat-pool July 28, 2026 21:35 — with GitHub Actions Inactive

PureWeen temporarily deployed to copilot-pat-pool July 28, 2026 21:37 — with GitHub Actions Inactive

PureWeen temporarily deployed to copilot-pat-pool July 28, 2026 21:38 — with GitHub Actions Inactive

PureWeen temporarily deployed to copilot-pat-pool July 28, 2026 21:39 — with GitHub Actions Inactive

github-actions Bot mentioned this pull request Jul 29, 2026

[PR Review Queue] 2026-07-29 #36901

Closed

kubaflo merged commit 1bd3f0c into main Jul 29, 2026
22 of 23 checks passed

kubaflo deleted the pureween-remove-invalid-codeowners branch July 29, 2026 12:49

github-actions Bot added this to the .NET 10 SR10 milestone Jul 29, 2026

github-actions Bot mentioned this pull request Jul 29, 2026

[Release Readiness] .NET 10 SR10 — candidate from main #36426

Open

Navigation Menu

Uh oh!

Remove invalid CODEOWNERS configuration - #36890

Remove invalid CODEOWNERS configuration#36890
kubaflo merged 1 commit into
mainfrom
pureween-remove-invalid-codeowners

PureWeen commented Jul 28, 2026

Uh oh!

github-actions Bot commented Jul 28, 2026

Uh oh!

azure-pipelines Bot commented Jul 28, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

PureWeen commented Jul 28, 2026

Uh oh!

kubaflo left a comment

Uh oh!

PureWeen commented Jul 28, 2026

Uh oh!

azure-pipelines Bot commented Jul 28, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Uh oh!

Conversation

PureWeen commented Jul 28, 2026

Description of Change

Issues Fixed

Uh oh!

github-actions Bot commented Jul 28, 2026

Uh oh!

azure-pipelines Bot commented Jul 28, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Copilot's findings

Uh oh!

PureWeen commented Jul 28, 2026

Uh oh!

kubaflo left a comment

Choose a reason for hiding this comment

Uh oh!

PureWeen commented Jul 28, 2026

Uh oh!

azure-pipelines Bot commented Jul 28, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants