extra-codeowners

Extra CODEOWNERS is a self-hosted GitHub App for teams that want automation to approve routine pull requests under a CODEOWNERS policy. It publishes a required check that accepts either a human CODEOWNER approval or an approval from an explicitly enrolled GitHub App. A repository can also opt in to treating an eligible pull-request author as human CODEOWNER evidence for that check. People and teams stay in GitHub's standard CODEOWNERS file, while a separate policy says which Apps may cover which owners and paths. The project exists because GitHub's Require review from Code Owners rule understands people and teams but does not let a GitHub App stand in for them. If an App such as Stampbot already knows a pull request is routine, GitHub still waits for a human code owner. Extra CODEOWNERS replaces that single decision with a check. It evaluates each distinct effective owner set separately. Every owner set represented by an owned path must pass. One pull request may use a human approval for one owner set and an App approval for another. An App approval qualifies only when the organization enrolled that exact App identity, the repository opted in, the delegation covers the changed path and effective CODEOWNER, any required labels are present, the approval applies to the current pull-request head, and no organization or built-in guardrail makes the path human-only. A pull request that mixes delegated and undelegated owned paths still needs human coverage for each undelegated owner set. A path with no effective CODEOWNERS match creates no code-owner requirement, although ordinary approval counts and other rules still apply. GitHub keeps ordinary pull-request rules: minimum approval count, stale-review handling, signed commits, and unrelated required checks. Extra CODEOWNERS is intended to replace only Require review from Code Owners. GitHub's public contract does not say whether a third-party App review counts toward the ordinary approval minimum, so that combination should be tested in a disposable repository before reliance. A nonzero minimum may still require a human even when the Extra CODEOWNERS check succeeds. The App does not submit reviews, merge pull requests, grant another App access, or edit CODEOWNERS. It reads GitHub evidence and publishes one Check Run. The check should be read as a policy result, not as a review. Extra CODEOWNERS appears in GitHub's checks area, while ordinary approval count appears in the review area. Teams should keep a normal minimum-review rule when needed. The check is asynchronous. When an approval is dismissed or changed, a prior success remains visible until GitHub delivers the event and the App resets and re-evaluates the check. Reconciliation repairs missed deliveries, but it is not an instantaneous revocation mechanism. GitHub's native code-owner rule should be kept for a boundary that cannot tolerate that stale-success window. Delegation is split across two policy scopes. CODEOWNERS decides which people or teams own each path. Organization policy decides which Apps are trusted at all, plus paths no App may cover. Repository policy decides which enrolled App may cover which owner and path in that repository. Repository policy can narrow organization policy, but it cannot enroll an App or weaken an organization guardrail. A repository policy is TOML with schema_version, enabled, and delegations containing app, paths, for_owners, and required_labels. The app value is an alias from the organization policy's apps table, which binds the alias to the App's immutable numeric ID, public slug, and bot-user ID. Example policy files are provided under examples/policy, and the configuration guide covers both scopes, path matching, labels, built-in protected files, and an insecure escape hatch. For local inspection, a clean checkout can be run with Bash, Git, and mise installed by cloning the repository and running mise trust, mise install, mise run bootstrap, and mise run test. The README advises reading mise.toml before mise trust because that command records a local trust decision. A successful run ends with the test suite passing. It does not register a GitHub App or prove the live GitHub contracts. To publish a check in a test repository, the first-check tutorial is provided. Native code-owner rules should stay enabled anywhere that matters. Alpha images and charts are for shadow-mode testing only and should be pinned by digest. The project is pre-release. Alpha images and charts are for non-required, shadow-mode testing only and should not enforce production merges. Legacy preview images such as main and its sha and sha256 companion tags are unsupported and unsafe for deployment because they predate the immutable release pipeline. The project status document separates what is usable today from what still blocks a supported release. Documentation includes project status, native CODEOWNERS comparison, threat model, development installation tutorial, configuration guide, troubleshooting guide, deployment and operations guides, recipient notice bundles, architecture and maintainer guides, and a contributor guide. The full manual is on Read the Docs. Project policies cover support, private vulnerability reporting, OpenSSL CVEs and VEX, governance, changelog, and Apache License 2.0. The badge set indicates CI, property testing, coverage, CodeQL, OpenSSF Scorecard, documentation, Python 3.12 through 3.14, and Apache-2.0 licensing.