Preview Feedback: Require review from specific team rule

[patrick-knight]

Required review by specific teams now available as a preview feature in rulesets

Take control of your protected branches! You can now use rulesets to require approvals from specific teams for changes to specific files and folders.

What's new

• Protect critical code by enforcing strict reviews for your most sensitive files.
• Scale your policies across any repository, organization, or your entire enterprise.
• Target specific paths and require a set number of reviews from specified teams.

Rulesets vs. CODEOWNERS

While CODEOWNERS is great for defining ownership, this new ruleset focuses on policy enforcement. It makes it simple to require specific approvals on sensitive branches and critical code paths, all while scaling seamlessly across your enterprise.

This new rule is designed to augment CODEOWNER files but not replace them. The CODEOWNERS files will continue to be the way to manage ownership, support individuals as reviewers, and request reviews even if not required.

---

🌟 Leave a comment!

What do you think? Join the discussion and leave your feedback below!

[AlexCK-STFC]

Great in theory, but it doesn't seem negation works right now, when it says it uses the same syntax as .gitignore files!

I.e. this does not work:

**
!safefile.txt
!/safe-folder/**
!/safe-folder/

PRs are still blocked + require specific approval if a negated/allowed file is edited.

[patrick-knight]

Thanks for the feedback @AlexCK-STFC.

That's a miss on our end, the supported format is actually in line with fnmatch and will be rolling out a tweak to UI's language soon.

If we could support negations could you talk more about how that would fit in your workflow?

[AlexCK-STFC]

We are continuous deploying an app from configuration stored on GitHub

Most files are sensitive, and changes require specific approval from X members of a specific team.

Changes to a small number of files, some config files, are safe, and should be allowed to be merged quickly without requiring those team-specific approvals.

Ideally we'd use a wildcard, while negating a small number of non-sensitive files. Otherwise we'd need to keep updating a large list of files, which is easier through CODEOWNERS than through the repo settings.

The advantage of this new solution, over codeowners, is it allows control over the number of approvers from that team, which can be greater than the repos default.

[AndreasPetersen]

I haven't had the chance to try this feature yet, since it's still in preview, and I would need to ask my organization manager to enable it. Before asking them, I have a question though. It seems unclear from the announcement what the exact behaviour is for pull requests. Is it similar to how CODEOWNERS work?

Specifically I'm curious if this feature addresses https://github.com/orgs/community/discussions/178776. We would really like to be able to assign/require a team as reviewer, so that the team is automatically added to any PR as specified by the ruleset, but keep the team there as individual members add reviews to the PR.

[stevehipwell]

@patrick-knight should this be supported in the REST API?