Prompt and context
Several teams share a repository, while security, payments, and data directories need clear responsibility. Explain how CODEOWNERS with branch protection or rulesets can create a discoverable, enforceable, auditable approval process, including exceptions and team changes.
What the interviewer evaluates
- Distinguishing CODEOWNERS automatic requests from required approval enforced by branch protection.
- Checking owners' write access, team visibility, target branch, and file location.
- Handling CODEOWNERS self-protection, forks, draft pull requests, bypasses, and stale approvals.
- Measuring governance with coverage, merge blocks, wait time, and audit records.
Clarifying questions to ask
- Which directories must block merges and which only need notification? Is there an emergency path?
- Are owners people or teams? How are visibility, write access, and rotation maintained?
- Which branches are protected? Are rulesets and classic protection both present, and who can bypass?
- How are CODEOWNERS itself, forks, draft PRs, stale approvals, and departing members handled?
30-second answer framework
I would map critical directories to accountable teams, then treat CODEOWNERS as the matching and notification layer and branch protection or rulesets as the merge-blocking layer. I would verify owner write access, team visibility, and the base-branch file; protect CODEOWNERS itself and define audited emergency bypasses. Simulated pull requests would cover added, moved, and deleted files and forks. I would monitor approval wait, blocks, bypasses, and orphaned paths.
Step-by-step deep dive
1. Define ownership boundaries
Partition directories by risk and change frequency instead of assigning one global team. Every pattern needs a primary owner, backup owner, and review date; regularly find paths with no match.
2. Separate requests from enforcement
CODEOWNERS automatically requests review when owned files change, but only required code-owner review in branch protection or a ruleset blocks the merge. Test both layers separately so a notification is not mistaken for enforcement.
3. Protect configuration and exceptions
Place CODEOWNERS in a protected location and assign an owner to it. For emergency fixes, use least-privilege bypass, a reason, and post-merge review; account for draft pull requests, forks, and approvals dismissed after new pushes.
4. Operate and migrate safely
Start in report mode to measure matching, orphaned paths, wait time, and false blocks before enforcing. Update permissions, rulesets, and audit queries together when teams or repositories change, and retain a rollback plan.
Model answer
I would partition the repository by risk, create CODEOWNERS with backup owners, and verify team visibility and write access. CODEOWNERS handles matching and notification; branch protection or rulesets provide the actual merge block, so I would validate both with simulated pull requests. The CODEOWNERS file itself would be protected and have an owner. Emergency bypasses would be least-privilege, justified, and reviewed afterward. I would begin in report mode, measure orphaned paths, false blocks, and wait time, then enforce gradually while monitoring stale approvals, bypasses, and coverage.
Common mistakes
- Assuming an automatic CODEOWNERS request always blocks a merge.
- Ignoring that teams must be visible and have write access.
- Leaving CODEOWNERS itself unprotected so ownership can be changed alone.
- Ignoring base branches, forks, drafts, or stale approvals.
- Omitting emergency bypass, post-review, and audit trails.
- Measuring approval count without orphan paths, wait time, or false blocks.
Follow-up questions and responses
Must every listed owner approve?
Normally one matching owner's approval satisfies code-owner review unless another rule says otherwise. Product design should specify whether high-risk directories need an additional multi-party rule.
Why protect CODEOWNERS itself?
Otherwise a contributor could change ownership mappings and then modify critical code, bypassing the intended boundary. Assigning an owner and requiring review for the file closes that path.
How do you avoid rotation-related blocks?
Use visible teams rather than individuals, maintain backups and change checks, audit orphan paths when access changes, and run a regression pull request before new rules become enforcing.