chore: add CODEOWNERS designating the devs team as code owners

[robnester-rh]

What

Add a CODEOWNERS file assigning all paths to the Conforma devs team.

Why

The repo had no CODEOWNERS, so code-owner review resolved to no one. A single * owner (the devs team) provides ownership for every path, including .github/, and lets code-owner review be required via branch protection.

Co-Authored-By: Claude noreply@anthropic.com
Ref: EC-2150

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Enterprise

Run ID: f7c6826f-ac08-40c9-b097-ca8ef70d6ced

📥 Commits

Reviewing files that changed from the base of the PR and between 047e1ae and 9fae521.

📒 Files selected for processing (1)

• .github/CODEOWNERS

Included review availability: Your plan provides up to 12 included reviews per hour; 9 remain after this review.

---

📝 Walkthrough

Walkthrough

The pull request adds default CODEOWNERS entries for all repository paths and explicitly includes .github/, assigning ownership to @conforma/devs.

Changes

CODEOWNERS coverage

Layer / File(s)	Summary
Repository ownership rules .github/CODEOWNERS	Adds default ownership entries for repository paths and .github/.

Estimated code review effort: 1 (Trivial) | ~2 minutes

Merge Risk: ⚪ Minimal · up to 9fae5

The change assigns repository paths to the devs team for code-owner review and introduces no actionable merge-blocking risk; it is ready after normal checks and review.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly and concisely describes the addition of CODEOWNERS for the devs team.
Description check	✅ Passed	The description explains what changed, why it changed, and includes the related reference EC-2150. The reference uses "Ref" instead of the template's "Tickets" heading, but the required information is…
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

Full details: Description check

Explanation

The description explains what changed, why it changed, and includes the related reference EC-2150. The reference uses "Ref" instead of the template's "Tickets" heading, but the required information is present.

Full details: Docstring Coverage

Explanation

No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (1 skipped: 1 unsupported.)

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands.}

[qodo-for-conforma]

PR Summary by Qodo

Add repository-wide ownership for the Conforma devs team

⚙️ Configuration changes 🕐 Less than 5 minutes

AI Description

• Assign all repository paths to the Conforma devs team.
• Enable required code-owner reviews through branch protection.

High-Level Assessment

A single wildcard rule is optimal because one team owns the entire repository, including .github. More granular path rules would add maintenance overhead without providing distinct ownership boundaries.

Files changed (1) +3 / -0

Other (1) +3 / -0

CODEOWNERSAssign all paths to the Conforma devs team +3/-0

Assign all paths to the Conforma devs team

• Adds a repository-wide CODEOWNERS rule assigning every path, including .github, to @conforma/devs. This supports mandatory code-owner approval through branch protection.

.github/CODEOWNERS

[qodo-for-conforma]

Code Review by Qodo

🐞 Bugs (0) 📘 Rule violations (0) 📎 Requirement gaps (0)

Great, no issues found!

Qodo reviewed your code and found no material issues that require review

Tip of the day

💡 Did you know, you can turn on the rule miner and Qodo learns your standards from review history

More tips ↗ | Customize Qodo ↗ | Qodo docs ↗

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 1:56 PM UTC · Completed 2:07 PM UTC

Commit: ca5794c · View workflow run →

Runtime: claude · Model: opus → claude-opus-4-6 · Effort: high · Cost: $2.06

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

Flag	Coverage Δ
acceptance	54.46% <ø> (+0.97%)	⬆️
generative	11.81% <ø> (-5.19%)	⬇️
integration	22.66% <ø> (-5.35%)	⬇️
unit	69.23% <ø> (+0.06%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.
see 31 files with indirect coverage changes

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[fullsend-ai-review]

Risk Assessment: moderate (2/5)

Details

Small config-only PR adding a CODEOWNERS file (1 file, 3 lines). The protected path signal elevates slightly above minimum. No security-sensitive files, no CI/dependency changes, non-bot experienced author.

[fullsend-ai-review]

Review

Findings

Medium

• [protected-path] .github/CODEOWNERS — This PR adds a file under a protected path (.github/). The PR references external tracker EC-2150 and provides a clear rationale for establishing code ownership via a catch-all * @conforma/devs rule. Human approval is always required for protected-path changes, regardless of context.

[fullsend-ai-review]

See the review comment for full details.

[fullsend-ai-review]

[medium] protected-path

This PR adds a file under a protected path (.github/). The PR references external tracker EC-2150 and provides a clear rationale for establishing code ownership via a catch-all * @conforma/devs rule. Human approval is always required for protected-path changes, regardless of context.

[fullsend-ai-review]

🤖 Review · ⚠️ Cancelled · Started 2:30 PM UTC · Ended 2:31 PM UTC

Commit: ca5794c · View workflow run →

[fullsend-ai-review]

Review skipped — this PR is already closed.

The /fs-review command only reviews open PRs/MRs.

_{Posted by fullsend pre-review check}

[fullsend-ai-retro]

🤖 Finished Retro · ✅ Success · Started 2:32 PM UTC · Completed 2:56 PM UTC

Commit: ca5794c · View workflow run →

Runtime: claude · Model: opus → claude-opus-4-6 · Effort: high · Cost: $3.75

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 2:32 PM UTC · Completed 2:36 PM UTC

Commit: ca5794c · View workflow run →

Runtime: claude · Model: opus → claude-opus-4-6 · Effort: high · Cost: $1.32

[fullsend-ai-review]

Review skipped — this PR is already closed.

The /fs-review command only reviews open PRs/MRs.

_{Posted by fullsend pre-review check}

[fullsend-ai-review]

Review skipped — this PR is already closed.

The /fs-review command only reviews open PRs/MRs.

_{Posted by fullsend post-review check}

[fullsend-ai-retro]

Retro: PR #3526 (closed) + PR #3527 (superseding)

PR #3526 added a 3-line .github/CODEOWNERS file assigning all paths to @conforma/devs. The author closed it without comment and opened identical PR #3527 five minutes later (likely to clear accumulated bot noise). The review agent ran on both PRs, spending ~$4.84 total for a trivial config change.

Key observations

1. Sub-agent model fallback inflated cost. The review agent tried to dispatch sub-agents on Sonnet but the model was unavailable, so all 4 dimension sub-agents + the challenger fell back to Opus. This is the ~5x cost inflation described in fullsend-ai/fullsend#6666. Related: fullsend-ai/agents#1116 (deployment-agnostic aliases), fullsend-ai/agents#379 (model unavailability handling).

2. Review cost disproportionate to PR scope. Opus at high effort for a 1-file, 3-line config addition resulted in $2.06 (PR #3526) and $2.78 (PR #3527). Existing issue fullsend-ai/fullsend#6891 (pre-flight scope heuristic) and fullsend-ai/agents#497 (scope-based model downgrade) would address this.

3. Inconsistent severity and verdict for identical content. The same CODEOWNERS file with the same PR body referencing EC-2150 received medium/COMMENTED on #3526 but high/CHANGES_REQUESTED on #3527. On #3526 the agent recognized the external tracker reference as authorization context; on #3527 it noted the absence of a linked GitHub issue and escalated. This inconsistency provides direct evidence for fullsend-ai/agents#718 (recognize external issue tracker references as authorization context for protected-path severity).

4. CHANGES_REQUESTED for human-only governance findings. On #3527, the review agent issued CHANGES_REQUESTED for a finding whose remediation is "a human reviewer must verify" — creating a bot-blocking review for something only a human can resolve. This is evidence for fullsend-ai/agents#1110 (use COMMENT verdict when all findings are human-only).

5. Pre-review skip worked correctly. The cancelled review runs (#33642449830, #33642530450) on the closed PR were caught by the pre-review check and skipped before agent execution, limiting waste to bootstrap overhead.

No new proposals

All improvement opportunities identified are covered by existing open issues. The evidence from this retro strengthens the case for the issues listed above, particularly #718 (inconsistent handling of external tracker refs) and #6891 (scope-based cost optimization).