[nyc1983]

[flagged]

[woodruffw]

Of the many things people have accused me of, being uninformed about GitHub Actions best practices is new.

(CODEOWNERS is a red herring: GitHub clearly intends for this policy mechanism to be used, and so it should be sound. Policy mechanisms should always be sound, even if there's a better or more general alternative mechanism. If GitHub intends CODEOWNERS to be that mechanism, then they should remove this one and document its replacement.)

[nyc1983]

Frankly I think your article focuses on an outdated or not relevant setting in GitHub. So the red herring is probably backwards here. There are tons of these (don’t get me started about topics and managing them for many repos), but GitHub has clearly been pushing rulesets over the past years and combined with CODEOWNERS this is the de-facto way of granularity managing who can make changes to GA workflows.

[YetAnotherNick]

CODEOWNERS is only for main branch AFAIK. You can run github action in commits.

[nyc1983]

CODEOWNERS combined with branch protection rules can require reviews for arbitrary branches matching a glob pattern.