A CODEOWNERS file assigns a reviewer to every path
Without a catch-all owner, a change to an unclaimed directory waits for someone to notice it. With one, the forge requests review automatically.
Observable check
where the forge supports Code Owners for the repository's visibility and plan, and two or more principals hold push, maintain, or admin access as R-SEC-12 reads it, a CODEOWNERS file exists in the repository root, .github/, .gitlab/, or docs/, and it contains a * rule naming at least one eligible owner. GitLab Free, private repositories on GitHub Free, and a repository where one principal holds every merge path fall outside this rule.
Where this comes from
Last read against these sources on 2026-07-28.
Confirms the .github/, root, and docs/ locations and the catch-all pattern. The page did not state the plan and visibility limits the rule's exemption relies on; that half is unverified. The solo exemption is not from this page either: it tracks R-SEC-12, because the forge requests review from an owner who is the only person who could merge the change anyway.