Add CODEOWNERS — auto-request reviewer routing (JavaScriptSolidServer#426)

melvincarvalho · web-flow · commit e3b243d5c9cc · 2026-05-13T09:47:00.000+02:00
Routes review requests for path categories explicitly: - Default (*) — @melvincarvalho - Auth / security paths (src/auth, src/idp, src/utils/ssrf.js) — @melvincarvalho explicitly, signalling security-sensitive surface - CLI / release surface (bin/, package.json, package-lock.json) — @melvincarvalho explicitly, since these affect what npm publishes - Legal / policy substrate (LICENSE, CONTRIBUTING.md, .github/) — @melvincarvalho explicitly Currently all paths route to the same maintainer; the per-path breakdown documents review responsibility intent for paths that should always get explicit maintainer review when contribution volume grows or co-maintainers are added. No enforcement: this just causes GitHub to auto-request review from listed owners on PRs touching matching paths. Without a branch-protection rule requiring CODEOWNERS approval the request is advisory.
diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS
@@ -0,0 +1,27 @@
+# CODEOWNERS — paths that auto-request review from the listed owners.
+#
+# GitHub matches paths in order. The most specific match for a given
+# file wins. The catch-all `*` pattern at the top covers everything
+# else; the path-specific entries below document review responsibility
+# for security-sensitive surfaces explicitly.
+#
+# Format reference:
+# https://docs.github.com/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/about-code-owners
+
+# Default — all files
+*                       @melvincarvalho
+
+# Auth / security-sensitive paths
+/src/auth/              @melvincarvalho
+/src/idp/               @melvincarvalho
+/src/utils/ssrf.js      @melvincarvalho
+
+# CLI and release surface
+/bin/                   @melvincarvalho
+/package.json           @melvincarvalho
+/package-lock.json      @melvincarvalho
+
+# Legal / policy substrate
+/LICENSE                @melvincarvalho
+/CONTRIBUTING.md        @melvincarvalho
+/.github/               @melvincarvalho
