psc-1944_add-codeowner-check-action

[harshil-roo]

JIRA: PSC-1944

---

Why this PR?

We're adding a CI/CD check to automatically validate your CODEOWNERS file on every commit.

---

The Problem

Invalid or misconfigured CODEOWNERS files can cause:

• Missed or incorrect code reviews
• Security gaps (anyone with write access can approve PRs)
• Slower workflows (missed team notifications)
• Audit issues (large or broken codeowner groups)

---

The Solution

A new CI check will:

• Warn if your CODEOWNERS file is missing or invalid
• Check that all listed teams/users exist and have write access

For now, this is a warning only.
We’ll make it blocking soon.

---

What to Do

1. Approve this PR, even if you see a warning.
2. Review your CODEOWNERS file and fix any issues. Confirm this PR is either updating an existing codeowners file or adding a new one.
3. Make sure your codeowners meet GitHub Security Standard.

---

For help, ask in #support-devsecops.

[Copilot]

Pull request overview

This PR adds automated CI validation for the CODEOWNERS file to catch configuration issues that could lead to missed reviews, security gaps, or audit problems. The check runs on every pull request as a warning-only step initially.

Key Changes:

• New GitHub Actions workflow that validates CODEOWNERS file integrity and team/user permissions
• Updated CODEOWNERS file to protect the new validation workflow itself

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

File	Description
.github/workflows/codeowner-check.yml	Defines the new CI workflow that calls a reusable validation workflow from the GHAS-enablement-repo
.github/CODEOWNERS	Adds ownership protection for the new codeowner-check workflow file

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

[nitpick] The workflow name should match the filename for consistency. Consider renaming to 'Codeowner Check' or updating the filename to 'codeowners-validation-call.yml'.

Suggested change

	name: CODEOWNERS Validation Call
	name: Codeowner Check

[Copilot]

Corrected spelling of 'codeowner' to 'codeowners' to match GitHub's terminology and the workflow filename.

Suggested change

	**/codeowner-check.yml @deliveroo/product-sec-eng # DO NOT MODIFY/REMOVE, AUTOGENERATED by DevSecOps
	**/codeowners-check.yml @deliveroo/product-sec-eng # DO NOT MODIFY/REMOVE, AUTOGENERATED by DevSecOps