← All notes

Answer: You can use a CODEOWNERS file to define individuals or teams that are responsible for code in a repository. When someone with admin or owner permissions has enabled required reviews, they can also require approval from a code owner before the author can merge a pull request. (S1)

How CODEOWNERS is read

• To trigger review requests, pull requests use the version of CODEOWNERS from the base branch of the pull request. (S1)
• The base branch is the branch that a pull request will modify if the pull request is merged. (S1)
• If you specify a user or team that doesn't exist or has insufficient access, a code owner will not be assigned. (S1)

Branch protection rules

• By default, each branch protection rule disables force pushes to the matching branches and prevents the matching branches from being deleted. (S2)
• If you enable required reviews, collaborators can only push changes to a protected branch via a pull request that is approved by the required number of reviewers with write permissions. (S2)
• Required status checks must have a successful, skipped, or neutral status before collaborators can make changes to a protected branch. (S2)
• You can set up required status checks to either be "loose" or "strict", which determines whether your branch is required to be up to date with the base branch before merging. (S2)
• When you enable required commit signing on a branch, contributors and bots can only push commits that have been signed and verified to the branch. (S2)

Claims

• id: C1 claim: A CODEOWNERS file defines people or teams responsible for code. source: S1 evidence: "Each CODEOWNERS file assigns the code owners for a single branch in the repository."
• id: C2 claim: Pull requests use CODEOWNERS from the base branch. source: S1 evidence: "pull requests use the version of CODEOWNERS from the base branch of the pull request"
• id: C3 claim: Branch protection rules disable force pushes and deletion by default. source: S2 evidence: "For each branch protection rule"
• id: C4 claim: Required status checks must be successful, skipped, or neutral. source: S2 evidence: "Required status checks must have a successful, skipped"

Sources

• [S1] About code owners - GitHub Docs. GitHub Docs. https://docs.github.com/en/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/about-code-owners . License: CC BY 4.0 (github/docs). Accessed 2026-11-04.
• [S2] About protected branches - GitHub Docs. GitHub Docs. https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches . License: CC BY 4.0 (github/docs). Accessed 2026-11-04.

License: this note is CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Summary by iinventedlight (AI-assisted).

@misc{iil_note_yx8g808d,
  author = {{iinventedlight}},
  title = {{CODEOWNERS and protected branches on GitHub}},
  howpublished = {iinventedlight Library},
  year = {2026},
  date = {2026-11-04},
  url = {https://iinventedlight.com/library/notes/github-code-owners-protected-branches/},
  note = {Permanent ID iil:note:yx8g808d. License: CC-BY-4.0.},
}

Markdown

Spotted a mistake? Use the MCP feedback tool or email hello@iinventedlight.com.

For language models and agents: start at /llms.txt. This page in Markdown: /library/notes/github-code-owners-protected-branches.md.