Add CODEOWNERS

[drinkcoffee]

Add CODEOWNERS file. The file makes the rollups team responsible for the repo in general and the rollups and the security teams responsible for the github actions.

---

Note

Low Risk
Repo metadata-only change that affects review routing but not runtime code or production behavior.

Overview
Adds a CODEOWNERS file to enforce review ownership across the repo.

Sets @immutable/rollups as the global owner and requires both @immutable/rollups and @immutable/security to review changes under .github (GitHub Actions/workflows).

^{Written by Cursor Bugbot for commit b9632ad. This will update automatically on new commits. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes and found 2 potential issues.

^{Bugbot Autofix is OFF. To automatically fix reported issues with Cloud Agents, enable Autofix in the Cursor dashboard.}

This is the final PR Bugbot will review for you during this billing cycle

Your free Bugbot reviews will reset on March 13

Details

Your team is on the Bugbot Free tier. On this plan, Bugbot will review limited PRs each billing cycle for each member of your team.

To receive Bugbot reviews on all of your PRs, visit the Cursor dashboard to activate Pro and start your 14-day free trial.

[cursor]

Global owner rule missing wildcard pattern

High Severity

The global ownership rule on line 2 is just @immutable/rollups without a file pattern. GitHub CODEOWNERS syntax requires each rule to be a file pattern followed by owner(s). For a global/default owner, the correct pattern is * @immutable/rollups. As written, @immutable/rollups is interpreted as a file path pattern, not an owner, so no global ownership is established.

 

[cursor]

GitHub Actions directory pattern may not match contents

Medium Severity

The pattern .github without a trailing slash likely only matches a file literally named .github, not the files inside the .github/ directory (like workflows). The idiomatic CODEOWNERS pattern for matching directory contents is .github/ or .github/**, which would correctly match all files within the directory.