feat(governance): ask the area steward for a review on pull requests that touch the area

Merged
FM
2d ago
+443-1

Why

Discussion #1442 opened area stewardship on 12 September and docs/governance/stewards.md records @Akisolu as the Windows and OpenCode steward since 14 September, but nothing in the repository carried the role: CODEOWNERS stayed * @Fmarzochi, no workflow asked the steward for a review (zero pull requests with review-requested:Akisolu in forty days), the steward had read permission only, and Windows had no label to triage by.

What changes

  • .github/stewards.json: the machine-readable twin of the stewards table, with the paths of each area (Windows and OpenCode accepted; Session Mesh and Installer invited).
  • scripts/ci/request-steward-review.js: given the changed files, the author and the reviewers already requested, prints the accepted stewards to ask, one per line. Globs take **, * and ? and ignore case; a steward is never asked on their own pull request; an invited area asks nobody.
  • .github/workflows/steward-review.yml: on pull_request_target (opened, reopened, ready for review) it checks out the base branch only, lists the pull request's files and requested reviewers through gh api, runs the script and requests the reviews. A steward who is not yet a collaborator produces a warning, not a failure, so no pull request goes red over it.
  • docs/governance/stewards.md gains "How the role is wired" (the review automation, the triage permission, the labels of each area); docs/MAINTAINERS.md names the permission level instead of "without elevated access".
  • The label platform: windows exists in the repository since this evening, next to tool: opencode.

Verification

  • node tests/ci/request-steward-review.test.js: 11 passed (globs, the author exclusion, invited areas, reviewers already requested, the CLI and its usage errors, the JSON against the table in the same order, an accepted area matching tracked files, the workflow's trigger, permissions and base-only checkout).
  • node scripts/ci/validate-workflow-security.js: 23 workflows validated; tests/ci/validate-workflow-security.test.js: 11 passed.
  • npx eslint on the script and the test: clean; the local pre-push gate: eslint 0, Sonar 0, duplication 0.

What stays with the maintainer

The triage permission for @Akisolu is a collaborator invitation only the maintainer sends; until it is accepted the workflow logs a warning where it would request the review.

Summary by cubic

Makes the area steward role real: pull requests touching a stewarded area now automatically request a review from that area's accepted steward instead of going only to the maintainer.

  • Adds .github/stewards.json (each area's paths and steward status) and a script that maps changed files to the stewards to ask, skipping the PR author and reviewers already requested.
  • Runs on pull_request_target, checks out the base branch only, and warns instead of failing when a steward is not yet a collaborator.
  • Updates the governance docs, docs/ROADMAP.md, and CHANGELOG.md; spells out the triage permission and the area labels.
  • The maintainer still sends the triage collaborator invitation to accepted stewards.