Compliance: codeowners-org-leads-not-first

[don-petry]

Compliance Finding

Category: settings
Severity: error
Check: codeowners-org-leads-not-first

Detail

CODEOWNERS owner lines must list @petry-projects/org-leads as the FIRST owner. Offending line: {"message":"Not Found","documentation_url":"https://docs.github.com/rest/repos/contents#get-repository-content","status":"404"}{"message":"Not Found","documentation_url":"https://docs.github.com/rest/repos/contents#get-repository-content","status":"404"}{"message":"Not Found","documentation_url":"https://docs.github.com/rest/repos/contents#get-repository-content","status":"404"}

Standard Reference

standards/codeowners-standard.md

Remediation

Run scripts/apply-repo-settings.sh .github with a token that has admin access to the repository (requires a classic PAT with repo scope or equivalent):

GH_TOKEN=<admin-pat> bash scripts/apply-repo-settings.sh .github

This script applies all standard settings defined in standards/github-settings.md in one pass.
For a dry run to preview changes without applying: DRY_RUN=true GH_TOKEN=<admin-pat> bash scripts/apply-repo-settings.sh .github

---

This issue was automatically created by the weekly compliance audit.

[don-petry]

Weekly Compliance Audit (2026-05-30)

This finding is still open.

Detail: CODEOWNERS owner lines must list @petry-projects/org-leads as the FIRST owner. Offending line: {"message":"Not Found","documentation_url":"https://docs.github.com/rest/repos/contents#get-repository-content","status":"404"}{"message":"Not Found","documentation_url":"https://docs.github.com/rest/repos/contents#get-repository-content","status":"404"}{"message":"Not Found","documentation_url":"https://docs.github.com/rest/repos/contents#get-repository-content","status":"404"}

Standard: standards/codeowners-standard.md

[don-petry]

@dev-lead

[don-petry]

@don-petry-dev-lead

[don-petry]

Weekly Compliance Audit (2026-06-05)

This finding is still open.

Detail: CODEOWNERS owner lines must list @petry-projects/org-leads as the FIRST owner. Offending line: {"message":"Not Found","documentation_url":"https://docs.github.com/rest/repos/contents#get-repository-content","status":"404"}{"message":"Not Found","documentation_url":"https://docs.github.com/rest/repos/contents#get-repository-content","status":"404"}{"message":"Not Found","documentation_url":"https://docs.github.com/rest/repos/contents#get-repository-content","status":"404"}

Standard: standards/codeowners-standard.md

[don-petry]

Dev-Lead Implementation Plan

Issue: #370 — Compliance: codeowners-org-leads-not-first

Scope

The current .github/CODEOWNERS already lists @petry-projects/org-leads as the first (and only) owner, so this finding is a false positive in check_codeowners (scripts/compliance-audit.sh).

Root cause: when gh api repos/.../contents/<path> returns a 404 for all three candidate paths, the gh_api retry loop accumulates the three error response bodies on stdout (the offending "line" in the finding is three concatenated {"message":"Not Found",...} JSON objects). The check then base64-decodes that string, the decode fails, and the raw JSON falls through to the "first owner is not @petry-projects/org-leads" branch.

Fix: harden the audit so a 404 (or any non-200 response) never gets mistaken for CODEOWNERS content.

Implementation Checklist

• scripts/compliance-audit.sh: make gh_api discard stdout on failed attempts so retries do not accumulate output
• scripts/compliance-audit.sh: have check_codeowners use gh api -i / status check (or only treat content as found when gh_api ... --jq '.content' succeeds AND the response actually contains a base64-decoded payload) so an error JSON cannot masquerade as the file
• No change to .github/CODEOWNERS itself — it already satisfies the standard

Tests to Write

• test/workflows/compliance-audit/check-codeowners.bats
  • All three paths return 404 → finding is missing-codeowners, never codeowners-org-leads-not-first
  • CODEOWNERS exists with * @petry-projects/org-leads → no findings
  • CODEOWNERS exists with a non-org-leads first owner → exactly the codeowners-org-leads-not-first finding fires
• test/workflows/compliance-audit/gh-api-retry.bats
  • Three consecutive failed gh api retries return an empty string from gh_api (no accumulated stdout)

Test Command

bats --print-output-on-failure test/workflows/compliance-audit/ plus repo lint bash .dev-lead/scripts/dev-lead-lint.sh