Require lead maintainer review for CODEOWNERS

[p-linnane]

Make CODEOWNERS owned by @Homebrew/lead-maintainers and @MikeMcQuaid, as it already is in Homebrew/homebrew-core. Without this, a pull request can change or remove any code owner rule with a single approval from any maintainer, which bypasses the review those rules require.

---

• Have you followed our Contributing guidelines?
• Have you checked for other open Pull Requests for the same change?
• Have you explained what your changes do? Performance claims (e.g. "this is faster") must include brew benchmark results.
• Have you explained why you'd like these changes included, not just what they do?
• For bug fixes, have you given step-by-step brew commands to reproduce the bug?
• Have you written new tests (excluding integration tests)? Here's an example.
• Have you successfully run brew lgtm (style, typechecking and tests) locally?

---

• I did not use AI/LLM to create this PR, or I disclosed the tool/model below and reviewed its output; I did not attribute commits to AI and will answer maintainer questions and review comments myself without AI/LLM.

Claude Code (Opus 5.5) made the change, checked that no later rule overrides the new entry, ran brew lgtm and checked the branch with GitHub's CODEOWNERS errors API. I reviewed the diff.

---

Summary by CodeRabbit

• Chores
  • Changes to the code ownership rules now require approval from designated maintainers. This affects how updates to those rules are reviewed and does not change the product’s functionality.

[coderabbitai]

📝 Walkthrough

A CODEOWNERS rule now assigns changes to the CODEOWNERS file to designated maintainers for approval.

Changes: CODEOWNERS Approval

Layer / File(s)	Summary
Assign CODEOWNERS approvals CODEOWNERS	A rule assigns changes to CODEOWNERS to designated maintainers for approval.

Priority: ⬇️ Low

Merge Risk: 🔵 Low · up to 91802

This PR can change CODEOWNERS without lead-maintainer approval because the new rule is not active on its base branch. Obtain an explicit lead approval before merging.

Security architecture risk: 🔵 Low · up to 91802

This change only adds a review requirement: edits to the code-ownership file must now be approved by the lead maintainers and a named maintainer. That narrows who can change the review rules, which reduces risk. It does not change any runtime code, dependency, or deployment. The remaining uncertainty is outside the source: the rule only takes effect if the repository requires code-owner review on the protected branch, and those settings could not be checked.

Retained concerns
No architecture-level concerns identified.

Security review details

Security Blast Radius

• inferred — Every other ownership rule depends on this control. Without it, a pull request could weaken or delete the rules for security-owned files such as the sandbox implementations on lines 14-18. With it enforced, such edits need lead-maintainer approval.

Security Findings and Attack Paths

• inferred — No security finding was retained. Both candidates are deferred, pending the branch-protection settings and a verifier receipt. The change reduces the existing exposure rather than adding to it.

Trust Boundaries and Controls

• observed — The authority to approve changes to the review-rules file moves from any approving maintainer to the lead-maintainers team and one named maintainer.

Hardening Proposals

• proposed — Confirm that the main-branch protection or ruleset requires code-owner review, and that admin bypass is restricted. Otherwise the new rule only suggests reviewers and does not enforce anything.

Pre-merge checks: 4

Passed checks: 4 passed

Check name	Status	Explanation
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title clearly and concisely describes the main change: requiring lead maintainer review for the CODEOWNERS file.
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

---

ℹ️ Review info

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: ba0b6359-20db-46ed-b3cb-5069aa27ba3a

📥 Commits

Reviewing files that changed from the base of the PR and between f63eb29 and 918022d.

📒 Files selected for processing: 1

• CODEOWNERS

Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 7 remain after this review.

[MikeMcQuaid]

Good idea!