fix(ci): put CODEOWNERS at a path GitHub actually reads (#6853)

Both copies were named CODEOWNERS.md, and GitHub only honours a file called CODEOWNERS with
no extension at the repo root, in .github/, or in docs/. None existed, so every path-to-team
mapping in this repo has been inert: no automatic review requests, nothing in a reviewer's
"awaiting your review" filter, no per-team sign-off state on a pull request. 67 of the 78
currently open pull requests have no requested reviewer.

Renaming alone would not have worked. Precedence is last-match-wins, and the project-wide "*"
line sat at the bottom of the file, so once GitHub started reading it the maintainers teams
would have owned everything and every area rule would have been dead. The default now comes
first, with narrower paths after it.

The two copies had also already drifted: .github/CODEOWNERS.md carried the corrected
providers/v1/ovh/ path while the root copy still had pkg/provider/v1/ovh/, and
lgtm-processor.js read the stale one. Collapsing to a single file removes that failure mode,
so lgtm.yml and lgtm-processor.js now read .github/CODEOWNERS.

Content changes, all verified against the tree and the org team list:

- dropped scripts/, build/ and test/, which do not exist in this repository
- dropped five provider lines whose reviewer teams do not exist (dvls, nebius, ngrok, ovh,
  volcengine); those paths now fall through to providers-reviewers instead of sitting on
  lines GitHub reports as errors
- added docs/ -> docs-maintainers and providers/v1/openbao/ -> provider-openbao-reviewers,
  where both the path and the team already exist
- merged the duplicate hack/ entry, which appeared under both CI and Testing; last-match-wins
  meant only testing-reviewers ever applied

deploy/ still has no entry because there is no charts reviewer team to point it at, so it
keeps falling through to the project-wide default.

node .github/scripts/lgtm-processor-test.js passes.

Signed-off-by: Alexander Chernov <alexander@chernov.it>

.github/CODEOWNERS

@@ -0,0 +1,67 @@
+# External Secrets CODEOWNERS
+#
+# Maps repository paths to GitHub teams for review. Syntax reference:
+# https://docs.github.com/en/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/about-code-owners
+#
+# Order matters: the LAST matching pattern wins. The project-wide default
+# therefore has to come first, with narrower paths after it.
+#
+# Teams need explicit write access to the repository, and a team that does not
+# exist makes its line a no-op, so keep this file in step with org teams.
+
+# --- Project-wide default (must stay first) ---
+*                                      @external-secrets/maintainers @external-secrets/interim-maintainers
+
+# --- CI / Infrastructure ---
+.github/                               @external-secrets/ci-reviewers
+hack/                                  @external-secrets/ci-reviewers @external-secrets/testing-reviewers
+
+# --- Testing ---
+tests/                                 @external-secrets/testing-reviewers
+e2e/                                   @external-secrets/testing-reviewers
+
+# --- Documentation ---
+docs/                                  @external-secrets/docs-maintainers
+
+# --- Core Controllers ---
+apis/                                  @external-secrets/core-reviewers
+pkg/controllers/                       @external-secrets/core-reviewers
+
+# --- Providers ---
+providers/v1/                          @external-secrets/providers-reviewers
+providers/v1/akeyless/                 @external-secrets/provider-akeyless-reviewers
+providers/v1/aws/                      @external-secrets/provider-aws-reviewers
+providers/v1/azure/                    @external-secrets/provider-azure-reviewers
+providers/v1/barbican/                 @external-secrets/provider-barbican-reviewers
+providers/v1/beyondtrust/              @external-secrets/provider-beyondtrust-reviewers
+providers/v1/bitwarden/                @external-secrets/provider-bitwarden-reviewers
+providers/v1/chef/                     @external-secrets/provider-chef-reviewers
+providers/v1/cloudru/                  @external-secrets/provider-cloudru-reviewers
+providers/v1/conjur/                   @external-secrets/provider-conjur-reviewers
+providers/v1/delinea/                  @external-secrets/provider-delinea-reviewers
+providers/v1/doppler/                  @external-secrets/provider-doppler-reviewers
+providers/v1/fake/                     @external-secrets/provider-fake-reviewers
+providers/v1/fortanix/                 @external-secrets/provider-fortanix-reviewers
+providers/v1/gcp/                      @external-secrets/provider-gcp-reviewers
+providers/v1/github/                   @external-secrets/provider-github-reviewers
+providers/v1/gitlab/                   @external-secrets/provider-gitlab-reviewers
+providers/v1/ibm/                      @external-secrets/provider-ibm-reviewers
+providers/v1/infisical/                @external-secrets/provider-infisical-reviewers
+providers/v1/keepersecurity/           @external-secrets/provider-keepersecurity-reviewers
+providers/v1/kubernetes/               @external-secrets/provider-kubernetes-reviewers
+providers/v1/onboardbase/              @external-secrets/provider-onboardbase-reviewers
+providers/v1/onepassword/              @external-secrets/provider-onepassword-reviewers
+providers/v1/onepasswordsdk/           @external-secrets/provider-onepasswordsdk-reviewers
+providers/v1/openbao/                  @external-secrets/provider-openbao-reviewers
+providers/v1/oracle/                   @external-secrets/provider-oracle-reviewers
+providers/v1/passbolt/                 @external-secrets/provider-passbolt-reviewers
+providers/v1/passworddepot/            @external-secrets/provider-passworddepot-reviewers
+providers/v1/previder/                 @external-secrets/provider-previder-reviewers
+providers/v1/pulumi/                   @external-secrets/provider-pulumi-reviewers
+providers/v1/scaleway/                 @external-secrets/provider-scaleway-reviewers
+providers/v1/secretserver/             @external-secrets/provider-secretserver-reviewers
+providers/v1/senhasegura/              @external-secrets/provider-senhasegura-reviewers
+providers/v1/vault/                    @external-secrets/provider-vault-reviewers
+providers/v1/webhook/                  @external-secrets/provider-webhook-reviewers
+providers/v1/yandex/                   @external-secrets/provider-yandex-reviewers
+

.github/CODEOWNERS.md

@@ -1,65 +0,0 @@
-# External Secrets CODEOWNERS
-# This file maps repository paths to GitHub teams for review.
-# Syntax: https://docs.github.com/en/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/about-code-owners
-
-# --- CI / Infrastructure ---
-.github/                      @external-secrets/ci-reviewers
-scripts/                      @external-secrets/ci-reviewers
-build/                        @external-secrets/ci-reviewers
-hack/                         @external-secrets/ci-reviewers
-
-# --- Testing ---
-test/                         @external-secrets/testing-reviewers
-e2e/                          @external-secrets/testing-reviewers
-tests/                        @external-secrets/testing-reviewers
-hack/                         @external-secrets/testing-reviewers
-
-# --- Core Controllers ---
-apis/                         @external-secrets/core-reviewers
-pkg/controllers/              @external-secrets/core-reviewers
-
-# --- Providers ---
-providers/v1/                         @external-secrets/providers-reviewers
-providers/v1/akeyless/                @external-secrets/provider-akeyless-reviewers
-providers/v1/aws/                     @external-secrets/provider-aws-reviewers
-providers/v1/azure/                   @external-secrets/provider-azure-reviewers
-providers/v1/barbican/                @external-secrets/provider-barbican-reviewers
-providers/v1/beyondtrust/             @external-secrets/provider-beyondtrust-reviewers
-providers/v1/bitwarden/               @external-secrets/provider-bitwarden-reviewers
-providers/v1/chef/                    @external-secrets/provider-chef-reviewers
-providers/v1/cloudru/                 @external-secrets/provider-cloudru-reviewers
-providers/v1/conjur/                  @external-secrets/provider-conjur-reviewers
-providers/v1/delinea/                 @external-secrets/provider-delinea-reviewers
-providers/v1/doppler/                 @external-secrets/provider-doppler-reviewers
-providers/v1/dvls/                    @external-secrets/provider-dvls-reviewers
-providers/v1/fake/                    @external-secrets/provider-fake-reviewers
-providers/v1/fortanix/                @external-secrets/provider-fortanix-reviewers
-providers/v1/gcp/                     @external-secrets/provider-gcp-reviewers
-providers/v1/github/                  @external-secrets/provider-github-reviewers
-providers/v1/gitlab/                  @external-secrets/provider-gitlab-reviewers
-providers/v1/ibm/                     @external-secrets/provider-ibm-reviewers
-providers/v1/infisical/               @external-secrets/provider-infisical-reviewers
-providers/v1/keepersecurity/          @external-secrets/provider-keepersecurity-reviewers
-providers/v1/kubernetes/              @external-secrets/provider-kubernetes-reviewers
-providers/v1/nebius/                  @external-secrets/provider-nebius-reviewers
-providers/v1/ngrok/                   @external-secrets/provider-ngrok-reviewers
-providers/v1/onboardbase/             @external-secrets/provider-onboardbase-reviewers
-providers/v1/onepassword/             @external-secrets/provider-onepassword-reviewers
-providers/v1/onepasswordsdk/          @external-secrets/provider-onepasswordsdk-reviewers
-providers/v1/oracle/                  @external-secrets/provider-oracle-reviewers
-providers/v1/ovh/                      @external-secrets/provider-ovh-reviewers
-providers/v1/passbolt/                @external-secrets/provider-passbolt-reviewers
-providers/v1/passworddepot/           @external-secrets/provider-passworddepot-reviewers
-providers/v1/previder/                @external-secrets/provider-previder-reviewers
-providers/v1/pulumi/                  @external-secrets/provider-pulumi-reviewers
-providers/v1/scaleway/                @external-secrets/provider-scaleway-reviewers
-providers/v1/secretserver/            @external-secrets/provider-secretserver-reviewers
-providers/v1/senhasegura/             @external-secrets/provider-senhasegura-reviewers
-providers/v1/vault/                   @external-secrets/provider-vault-reviewers
-providers/v1/volcengine/              @external-secrets/provider-volcengine-reviewers
-providers/v1/webhook/                 @external-secrets/provider-webhook-reviewers
-providers/v1/yandex/                  @external-secrets/provider-yandex-reviewers
-
-
-# --- Maintainers (project-wide) ---
-*                            @external-secrets/maintainers @external-secrets/interim-maintainers

.github/scripts/lgtm-processor.js

@@ -2,7 +2,7 @@
  * LGTM Command Processor
  *
  * Processes /lgtm comments on pull requests. Checks if the commenter has the
- * required reviewer role(s) based on CODEOWNERS.md, then adds the lgtm label
+ * required reviewer role(s) based on .github/CODEOWNERS, then adds the lgtm label
  * and posts a confirmation comment.
  *
  * @param {object} params
@@ -30,15 +30,15 @@ export default async function run({ core, github, context, fs }) {
   const commenter = context.payload.comment.user.login;
   const prNumber = context.payload.issue.number;
 
-  // Parse CODEOWNERS.md file
+  // Parse the CODEOWNERS file
   let codeownersContent;
   try {
-    codeownersContent = fs.readFileSync('CODEOWNERS.md', 'utf8');
+    codeownersContent = fs.readFileSync('.github/CODEOWNERS', 'utf8');
   } catch (error) {
     return;
   }
 
-  // Extract role mappings from CODEOWNERS.md (including * pattern)
+  // Extract role mappings from CODEOWNERS (including * pattern)
   const codeownerMappings = [];
   let wildcardRoles = [];
   codeownersContent.split('\n').forEach(line => {

.github/workflows/lgtm.yml

@@ -12,17 +12,17 @@ jobs:
     permissions:
       pull-requests: write  # for peter-evans/slash-command-dispatch to create PR reaction
       issues: write        # for adding labels and comments
-      contents: read       # for reading CODEOWNERS.md
+      contents: read       # for reading .github/CODEOWNERS
     runs-on: ubuntu-latest
     # Only run for PRs, not issue comments
     if: ${{ github.event.issue.pull_request }}
     steps:
-    # Checkout repo to access CODEOWNERS.md
+    # Checkout repo to access .github/CODEOWNERS
     - name: Checkout repository
       uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       with:
         sparse-checkout: |
-          CODEOWNERS.md
+          .github/CODEOWNERS
           .github/scripts
         persist-credentials: false
 

CODEOWNERS.md

@@ -1,65 +0,0 @@
-# External Secrets CODEOWNERS
-# This file maps repository paths to GitHub teams for review.
-# Syntax: https://docs.github.com/en/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/about-code-owners
-
-# --- CI / Infrastructure ---
-.github/                      @external-secrets/ci-reviewers
-scripts/                      @external-secrets/ci-reviewers
-build/                        @external-secrets/ci-reviewers
-hack/                         @external-secrets/ci-reviewers
-
-# --- Testing ---
-test/                         @external-secrets/testing-reviewers
-e2e/                          @external-secrets/testing-reviewers
-tests/                        @external-secrets/testing-reviewers
-hack/                         @external-secrets/testing-reviewers
-
-# --- Core Controllers ---
-apis/                         @external-secrets/core-reviewers
-pkg/controllers/              @external-secrets/core-reviewers
-
-# --- Providers ---
-providers/v1/                         @external-secrets/providers-reviewers
-providers/v1/akeyless/                @external-secrets/provider-akeyless-reviewers
-providers/v1/aws/                     @external-secrets/provider-aws-reviewers
-providers/v1/azure/                   @external-secrets/provider-azure-reviewers
-providers/v1/barbican/                @external-secrets/provider-barbican-reviewers
-providers/v1/beyondtrust/             @external-secrets/provider-beyondtrust-reviewers
-providers/v1/bitwarden/               @external-secrets/provider-bitwarden-reviewers
-providers/v1/chef/                    @external-secrets/provider-chef-reviewers
-providers/v1/cloudru/                 @external-secrets/provider-cloudru-reviewers
-providers/v1/conjur/                  @external-secrets/provider-conjur-reviewers
-providers/v1/delinea/                 @external-secrets/provider-delinea-reviewers
-providers/v1/doppler/                 @external-secrets/provider-doppler-reviewers
-providers/v1/dvls/                    @external-secrets/provider-dvls-reviewers
-providers/v1/fake/                    @external-secrets/provider-fake-reviewers
-providers/v1/fortanix/                @external-secrets/provider-fortanix-reviewers
-providers/v1/gcp/                     @external-secrets/provider-gcp-reviewers
-providers/v1/github/                  @external-secrets/provider-github-reviewers
-providers/v1/gitlab/                  @external-secrets/provider-gitlab-reviewers
-providers/v1/ibm/                     @external-secrets/provider-ibm-reviewers
-providers/v1/infisical/               @external-secrets/provider-infisical-reviewers
-providers/v1/keepersecurity/          @external-secrets/provider-keepersecurity-reviewers
-providers/v1/kubernetes/              @external-secrets/provider-kubernetes-reviewers
-providers/v1/nebius/                  @external-secrets/provider-nebius-reviewers
-providers/v1/ngrok/                   @external-secrets/provider-ngrok-reviewers
-providers/v1/onboardbase/             @external-secrets/provider-onboardbase-reviewers
-providers/v1/onepassword/             @external-secrets/provider-onepassword-reviewers
-providers/v1/onepasswordsdk/          @external-secrets/provider-onepasswordsdk-reviewers
-providers/v1/oracle/                  @external-secrets/provider-oracle-reviewers
-pkg/provider/v1/ovh/                  @external-secrets/provider-ovh-reviewers
-providers/v1/passbolt/                @external-secrets/provider-passbolt-reviewers
-providers/v1/passworddepot/           @external-secrets/provider-passworddepot-reviewers
-providers/v1/previder/                @external-secrets/provider-previder-reviewers
-providers/v1/pulumi/                  @external-secrets/provider-pulumi-reviewers
-providers/v1/scaleway/                @external-secrets/provider-scaleway-reviewers
-providers/v1/secretserver/            @external-secrets/provider-secretserver-reviewers
-providers/v1/senhasegura/             @external-secrets/provider-senhasegura-reviewers
-providers/v1/vault/                   @external-secrets/provider-vault-reviewers
-providers/v1/volcengine/              @external-secrets/provider-volcengine-reviewers
-providers/v1/webhook/                 @external-secrets/provider-webhook-reviewers
-providers/v1/yandex/                  @external-secrets/provider-yandex-reviewers
-
-
-# --- Maintainers (project-wide) ---
-*                            @external-secrets/maintainers @external-secrets/interim-maintainers

OWNERS.md

@@ -1,7 +1,7 @@
 # External Secrets Owners
 
 This document maps **specialty areas** to GitHub teams used for reviews and approvals.  
-It complements the automation in [`CODEOWNERS`](./CODEOWNERS) and the roles defined in
+It complements the automation in [`CODEOWNERS`](./.github/CODEOWNERS) and the roles defined in
 [`CONTRIBUTOR_LADDER.md`](./CONTRIBUTOR_LADDER.md).
 
 - **Reviewer**: may review and `/lgtm` within their specialty.