Back to Checks
github

Repository has a CODEOWNERS file

repository_has_codeowners_file
Service: repositorySeverity: medium
OfficialBuilt-inVerified
Categories:software-supply-chain
Resource Type:NotDefined

GitHub repositories declare code ownership via a CODEOWNERS file mapping file patterns to users or teams. This evaluation checks whether such a file exists in standard locations (/, .github/, or docs/) to enable automatic reviewer assignment.

Prowler logoProwlerprowler-provider-github

Risk

Missing CODEOWNERS undermines integrity and separation of duties:

  • PRs can merge without accountable, domain reviews
  • Critical paths risk unauthorized or low-quality changes This raises software supply chain exposure, enabling code tampering, hidden backdoors, and unsafe config modifications.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler github --checks repository_has_codeowners_file

Recommendation

Define and maintain a CODEOWNERS file mapping sensitive paths to responsible teams or users, preferring teams for resilience. Combine with branch protections requiring code-owner reviews to enforce separation of duties and least privilege. Keep entries current and cover critical directories to avoid pattern gaps.

Remediation

CLI

gh api -X PUT repos/<example_org_or_user>/<example_repo>/contents/.github/CODEOWNERS -f message='add CODEOWNERS' -f content="$(printf '* @<example_owner>\n' | base64 | tr -d '\n')"

Terraform

resource "github_repository_file" "<example_resource_name>" {
  repository = "<example_repo>"
  file       = ".github/CODEOWNERS"  # Critical: creates the CODEOWNERS file so the check passes
  content    = "* @<example_owner>"   # Critical: minimal valid content so the file is recognized
}

Other

1In GitHub, open the target repository
2Click Add file > Create new file
3Set the filename to .github/CODEOWNERS
4Add a single line: `* @<example_owner>`
5Click Commit new file (commit to the default branch)

Check Code

from typing import List

from prowler.lib.check.models import Check, CheckReportGithub
from prowler.providers.github.services.repository.repository_client import (
    repository_client,
)


class repository_has_codeowners_file(Check):
    """Check if a repository has a CODEOWNERS file

    This class verifies whether each repository has a CODEOWNERS file.
    """

    def execute(self) -> List[CheckReportGithub]:
        """Execute the Github Repository CODEOWNERS file existence check

        Iterates over all repositories and checks if they have a CODEOWNERS file.

        Returns:
            List[CheckReportGithub]: A list of reports for each repository
        """
        findings = []
        for repo in repository_client.repositories.values():
            if repo.archived:
                continue

            if repo.codeowners_exists is not None:
                report = CheckReportGithub(metadata=self.metadata(), resource=repo)
                if repo.codeowners_exists:
                    report.status = "PASS"
                    report.status_extended = (
                        f"Repository {repo.name} does have a CODEOWNERS file."
                    )
                else:
                    report.status = "FAIL"
                    report.status_extended = (
                        f"Repository {repo.name} does not have a CODEOWNERS file."
                    )

                findings.append(report)

        return findings

References