[MusaMisto]

Removes .github/CODEOWNERS. It has never worked.

• Its only line is * simplify9/reviewers, which is missing the @. GitHub's CODEOWNERS check reports "Invalid owner" on line 1, so no review has ever been requested through it.
• The reviewers team it names was deleted on 2026-11-04 during the org teams cleanup.
• Review is still required. The org ruleset "Default branch: PR + team approval" requires an approval from @simplify9/code-reviewers on every PR into main, and this PR does not change that.

Nothing changes except the "Invalid owner" error goes away.

Before merging, note: a push to main runs this repo's publish/deploy workflow, which has no path filter. Merging this PR as-is would publish a new patch version (or redeploy, for SW-Surl-api) with no code change. Squash-merge with [ci skip] in the commit subject to avoid that.

[coderabbitai]

No actionable comments were generated in the recent review.

Summary

• What changed: Removed .github/CODEOWNERS, which contained one invalid owner entry. No application code changed.
• Risk: risk:low.
• Security-sensitive areas: None. The change affects review ownership configuration, not application security controls.
• Test coverage impact: No test coverage change. No test results were provided.
• Operational concerns: Removing the file stops its CODEOWNERS-based review assignment. The PR description says the organization ruleset still requires approval from @simplify9/code-reviewers for PRs into main. The npm publish workflow runs on pushes to main; the PR description warns that merging may publish a patch version or redeploy. Use [ci skip] in the squash commit subject if that workflow must be avoided.

The .github/CODEOWNERS file no longer assigns all matching paths to simplify9/reviewers.

Changes: Ownership Rule

Layer / File(s)	Summary
Remove global ownership rule .github/CODEOWNERS	The rule that assigned all matching paths to simplify9/reviewers was removed.

Estimated code review effort: 1 (Trivial) | ~3 minutes

Change: Other

Suggested labels: risk:low

Suggested reviewers: samerzughul

Merge Risk: Minimal · up to ec8fd

No actionable risk from this change is established. It is mergeable after normal checks, with the reported publish-on-merge behavior handled through the planned merge procedure.

Pre-merge checks: 5

Check name	Status	Explanation
Title check		The title clearly identifies the removal of the invalid CODEOWNERS configuration and explains the reason.
Description check		The description directly explains the CODEOWNERS removal, invalid owner, preserved review requirement, and deployment impact.
Docstring Coverage		No eligible functions found in the changed files. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentat…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

No eligible functions found in the changed files. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentation-only edits and deletions within surviving functions are included; unchanged diff context and fully deleted functions are excluded. Analyzed 0 functions across 0 files.

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn

Recent review info

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Central YAML; Path: .coderabbit.yaml
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: d3a7b007-c3ac-42ab-ad1c-239f6772d9b1

Commits

Reviewing files that changed from the base of the PR and between 83afe24 and ec8fd1b.

Files selected for processing: 1

• .github/CODEOWNERS

Files with no reviewable changes: 1

• .github/CODEOWNERS

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.

Recent review details

Context from checks skipped due to timeout: 1

• GitHub Check: CodeRabbit

CI failures not shown inline: 2

GitHub Actions: vuln-check-37 / 0_vuln-gate _ check.txt: vuln-check-37

Conclusion: failure

View job details

�[36;1mecho "::group::[CHECKPOINT 1/1] Query Open Critical Dependabot Alerts"�[0m
 �[36;1m�[0m
 �[36;1mif [[ -z "$DEPENDABOT_TOKEN" ]]; then�[0m
 �[36;1m  echo "::error title=[VULN-GATE] Missing dependabot-alerts-***REDACTED_SECRET_ASSIGNMENT*** - this gate requires a PAT/App token with 'Dependabot alerts: read', forwarded explicitly by the caller (GITHUB_TOKEN cannot access this API regardless of granted permissions). Add a dependabot-alerts-token entry (set to the DEPENDABOT_ALERTS_TOKEN org secret) to this job's secrets block in the caller workflow. Fails closed until forwarded."�[0m
...
 �[36;1m    -H "Accept: application/vnd.github+json" \�[0m
 �[36;1m    -H "X-GitHub-Api-Version: 2022-11-28" \�[0m
 �[36;1m    "$url")" || curl_exit=$?�[0m
 �[36;1m�[0m
 �[36;1m  if [[ $curl_exit -ne 0 ]]; then�[0m
 �[36;1m    echo "::error title=[VULN-GATE] Dependabot Alerts API request failed::Network/transport error (curl exit ${curl_exit}) querying ${REPOSITORY} on page ${page_num}. This gate fails closed on any error, including connectivity issues."�[0m
...
 �[36;1m    echo "::endgroup::"�[0m
 �[36;1m    exit 1�[0m
 �[36;1m  fi�[0m
 �[36;1m�[0m
 �[36;1m  if [[ "$http_code" == "401" || "$http_code" == "403" ]]; then�[0m
 �[36;1m    echo "::error title=[VULN-GATE] Dependabot Alerts token rejected::${REPOSITORY} returned HTTP ${http_code}. The dependabot-alerts-token input must be a real PAT/App token with 'Dependabot alerts: read' -- GITHUB_TOKEN cannot access this API regardless of granted permissions, confirmed by live testing. This gate fails closed until a valid token is forwarded. Response: $(cat "$response_file")"�[0m
...
 �[36;1m    echo "::endgroup::"�[0m
 �[36;1m    exit 1�[0m
 �[36;1m  fi�[0m
 �[36;1m�[0m
 �[36;1m  if [[ ! "$http_code" =~ ^2[0-9][0-9]$ ]]; then�[0m
 �[36;1m    echo "::error title=[VULN-GATE] Dependabot Alerts API call failed::HTTP ${http_code} on page ${page_num} for ${REPOSITORY}. Response: $(cat "$response_file")"�[0m
...
 �[36;1m  echo "::group...

GitHub Actions: vuln-check-37 / vuln-gate _ check: vuln-check-37

Conclusion: failure

View job details

�[36;1mecho "::group::[CHECKPOINT 1/1] Query Open Critical Dependabot Alerts"�[0m
 �[36;1m�[0m
 �[36;1mif [[ -z "$DEPENDABOT_TOKEN" ]]; then�[0m
 �[36;1m  echo "::error title=[VULN-GATE] Missing dependabot-alerts-***REDACTED_SECRET_ASSIGNMENT*** - this gate requires a PAT/App token with 'Dependabot alerts: read', forwarded explicitly by the caller (GITHUB_TOKEN cannot access this API regardless of granted permissions). Add a dependabot-alerts-token entry (set to the DEPENDABOT_ALERTS_TOKEN org secret) to this job's secrets block in the caller workflow. Fails closed until forwarded."�[0m
...
 �[36;1m    -H "Accept: application/vnd.github+json" \�[0m
 �[36;1m    -H "X-GitHub-Api-Version: 2022-11-28" \�[0m
 �[36;1m    "$url")" || curl_exit=$?�[0m
 �[36;1m�[0m
 �[36;1m  if [[ $curl_exit -ne 0 ]]; then�[0m
 �[36;1m    echo "::error title=[VULN-GATE] Dependabot Alerts API request failed::Network/transport error (curl exit ${curl_exit}) querying ${REPOSITORY} on page ${page_num}. This gate fails closed on any error, including connectivity issues."�[0m
...
 �[36;1m    echo "::endgroup::"�[0m
 �[36;1m    exit 1�[0m
 �[36;1m  fi�[0m
 �[36;1m�[0m
 �[36;1m  if [[ "$http_code" == "401" || "$http_code" == "403" ]]; then�[0m
 �[36;1m    echo "::error title=[VULN-GATE] Dependabot Alerts token rejected::${REPOSITORY} returned HTTP ${http_code}. The dependabot-alerts-token input must be a real PAT/App token with 'Dependabot alerts: read' -- GITHUB_TOKEN cannot access this API regardless of granted permissions, confirmed by live testing. This gate fails closed until a valid token is forwarded. Response: $(cat "$response_file")"�[0m
...
 �[36;1m    echo "::endgroup::"�[0m
 �[36;1m    exit 1�[0m
 �[36;1m  fi�[0m
 �[36;1m�[0m
 �[36;1m  if [[ ! "$http_code" =~ ^2[0-9][0-9]$ ]]; then�[0m
 �[36;1m    echo "::error title=[VULN-GATE] Dependabot Alerts API call failed::HTTP ${http_code} on page ${page_num} for ${REPOSITORY}. Response: $(cat "$response_file")"�[0m
...
 �[36;1m  echo "::group...