IIUC

• owners / owner teams will be notified and assigned as reviewers on PRs that change matching files
• we can set up a rule to require reviews from an owner to enable PR merging

What is the benefit over the status quo, it it solving a problem, or addressing some security concern?

What is the benefit over the status quo, it it solving a problem, or addressing some security concern?

So each line in the file will contain a rule, and the rule will consist of a glob and the team that is allowed to approve changes to matching files. For now, I'm suggesting to require the admins approval on sensible files and the infrastructure team for changes in the .github/workflows folder. Over the status quo, anybody can approve any changes so the proposed solution is more secure.

I understand that some cleanup around the Scala organization was probably needed. However, my two cents is that we should be cautious about adding further restrictions just for the sake of it. The potential negative impact on usability and the time it takes to deal with these restrictions may outweigh the security benefits. From a community perspective, we should also make sure that these measures don’t lead to contributors feeling mistrusted or infantilized.

well, I haven't been feeling the lack of this

still, I would say that as it stands this seems mergeable, at least as a trial, since only a few files are listed and the ownership on the files listed is so clear

but I don't think there should be any expectation that we gradually expand this to cover lots of files