Atmos Pro Logo

Atmos Pro

ProductPricingDocsBlogChangelog
Create Workspace
← Back to Changelog
Feature

CODEOWNERS Validation on Pull Requests

Erik Osterman

Erik Osterman

CEO & Founder of Cloud Posse

|May 11, 2026

Older

MCP Server (Beta)

Erik Osterman

Erik Osterman

CEO & Founder of Cloud Posse

Erik is the founder of Cloud Posse and creator of Atmos. With over a decade of experience helping teams adopt Terraform at scale, he is passionate about open-source infrastructure tooling and developer experience.

Book a Meeting
Atmos Pro Logo

Atmos Pro

The fastest way to deploy your apps on AWS with Terraform and GitHub Actions.

GitHubTwitterLinkedInYouTubeSlack

For Developers

  • Quick Start
  • Example Workflows
  • Atmos Documentation

Community

  • Register for Office Hours
  • Join the Slack Community
  • Try our Newsletter

Company

  • About Cloud Posse
  • Security
  • Pricing
  • Blog
  • Media Kit

Legal

  • SaaS Agreement
  • Terms of Use
  • Privacy Policy
  • Disclaimer
  • Cookie Policy

© 2026 Cloud Posse, LLC. All rights reserved.

Checking status...

A built-in CODEOWNERS validator

A CODEOWNERS file tells GitHub who must review changes to each path before they can merge — but the format fails open. A misspelled team name or stray inline comment causes GitHub to drop owners from a pattern with no warning, silently losing review coverage. Cloud Posse repositories have run a third-party validator action for years, but it requires a PAT with read:org to enumerate teams, and rotating that token across every repo turned into a recurring tax.
Atmos Pro now does the check natively. When a pull request modifies a CODEOWNERS file at any of the three GitHub locations (CODEOWNERS, .github/CODEOWNERS, docs/CODEOWNERS), the result is folded directly into the existing Atmos Pro check on the PR. A CODEOWNERS failure fails the composite check; the comment that the check links to lists every issue with its line number. PRs that don't touch CODEOWNERS skip the validator entirely — no noisy passing checks on every commit, and no second status check fighting for attention in the PR sidebar.

Validate CODEOWNERS on pull requests

When a pull request modifies a CODEOWNERS file, Atmos Pro posts a check run that validates syntax, verifies every referenced user and team exists, and flags duplicate patterns. The check is skipped on PRs that don't touch CODEOWNERS.

How it works

The behavior is a per-repository toggle on the Settings tab, off by default so existing branch protection rules don't suddenly start failing. Toggle it on for any repo where CODEOWNERS should be enforced — branch protection on the existing Atmos Pro check now also gates CODEOWNERS quality without any extra configuration.
The validator runs the same three checks our existing GitHub Action runs internally:
  • syntax — each line is <pattern> <owner1> [<owner2> ...] with no inline # comments, and every owner is a valid @user, @org/team, or email address
  • owners — each @user resolves via GET /users/:login; each @org/team resolves via GET /orgs/:org/teams/:slug
The team check uses the Atmos Pro GitHub App's installation token — no PAT to rotate, no per-repo secret to keep alive.
duplicate patterns (duppatterns) — the same file pattern listed on two different lines