change/code-owner-review
Changes to the default branch need approval from the code owners of the files they touch.
Install
firedrill hub add change/code-owner-review
Reads
github.repos, github.branch_rules
Fix when it fails
Add a CODEOWNERS file covering the code that matters, then turn on Require review from Code Owners in the default branch's protection or ruleset.
Maps to
SOC2:CC8.1, ISO27001:A.8.32
Test cases
| Case | Expected |
|---|---|
| code owners must approve | PASS |
| any reviewer will do | FAIL |
| code owners on, but no approval required | FAIL |
| free plan, private repo | N/A |
Drill file
firedrill: v0
id: change/code-owner-review
safeguard: "Changes to the default branch need approval from the code owners of the files they touch."
source: "https://best.openssf.org/SCM-BestPractices/github/repository/code_review_not_limited_to_code_owners.html"
author: "@sk1122"
severity: high
for_each: github.repos
fetch:
rules: { fact: github.branch_rules, args: { branch: default } }
applies_when: target.protection_available
na_reason: "the plan has no branch protection on private repos"
pass_when:
- rules.required_approvals >= 1
- rules.code_owner_review == true
fix: "Add a CODEOWNERS file covering the code that matters, then turn on Require review from Code Owners in the default branch's protection or ruleset."
maps_to: [SOC2:CC8.1, ISO27001:A.8.32]