Is it possible to add GitHub Apps Bot to CODEOWNERS?

[0gajun]

Hi, there

I wanna add my GitHub Apps bot to CODEOWNERS to automate approval processes.

I’ve already tried to do it like following, but not work.

/example-path @our-githubapps-bot-name  

The bot has access to the repository with read&write permission.

Is it possible to add the bot to CODEOWNERS or not? 

If possible, how can I define CODEOWNERS?

[AndreaGriffiths11]

Hi @0gajun,

Thank you for being here! Currently, GitHub Apps can’t be used in CODEOWNERS – that’s not supported. It’s something the team is considering for the future, and I’ll be sure to add your use case to the internal feature request.

[cjthom03]

Hi, has there been any movement on this? Thanks.

[CatalinaMoisuc]

Any news on this? Is this planned?

We also need it to be able to add https://github.com/apps/renovate-approve as a code owner so we can auto-merge dependency updates PRs opened by Renovate.

@AndreaGriffiths11 is there a GitHub issue opened for this feature request? Would be cool to be able to subscribe to it for updates.

[Shegox]

Just to add the workaround we are using internally, might be helpful for somebody else as well:

Due to a limitation in GitHub, it's not possible to assign an GitHub App, such as this one (renovate-approver), as a CODEOWNER. This means you cannot use CODEOWNERS directly with the Renovate-approver app.
However, GitHub does allow you to effectively disable the CODEOWNER for specific files in your repository. You can do this by not assigning a CODEOWNER to those files.

For example, if you wish to disable the CODEOWNER for your package.json and package-lock.json files, you can do so by excluding them from your CODEOWNERS file like this:

*              some-codeowner-user
package.json
package-lock.json

In this configuration, some-codeowner-user is assigned as the CODEOWNER for all files in the repository (*) except for package.json and package-lock.json, which have no assigned CODEOWNER.

[pexa-slee]

Legend!

[hardboiled]

I wrote a github app to merge code automatically if it passes CI checks and meets certain criteria that would designate the PR as a minimal change. For more involved changes, we do want owners to approve. It works in my test repo, but the repo I installed it on eventually has a CODEOWNERS file. When the app attempts to merge, I get an error message as shown below, even though it has merge access. There doesn’t seem to be any way to override this message, and this response is completely undocumented. Between this and github actions, I’ve had multiple mishaps and re-writes that I’ve had to do that have resulted in around 1-2 weeks of lost time on this project, primarily due to documentation issues and frankly bugs on what the docs say github supports. It would be nice if this stuff would work as documented and if bots with merge access wouldn’t get error messages back saying they can’t merge. Even just a force parameter to override the error message would give me what I need, but that doesn’t appear to exist.

# with merge bot (github app) token
$ curl -X PUT -H “Authorization: Bearer $INSTALL_TOKEN” -H “Accept: application/vnd.github.machine-man-preview+json” -H ‘Content-Type: application/json’ ‘https://api.github.com/repos/my-repo/pulls/234/merge’
-d ‘{
“commit_title”: “test merge by manually calling github API”,
“commit_message”: “Test commit”,
“merge_method”: “merge”
}’ | python -m ‘json.tool’
{
“message”: “Waiting on code owner review from <owner>”,
“documentation_url”: “https://help.github.com/articles/about-protected-branches”
}

# with user API token
curl -X PUT -H “Authorization: Bearer $GITHUB_TOKEN” -H “Accept: application/vnd.github.machine-man-preview+json” -H ‘Content-Type: application/json’ ‘https://api.github.com/repos/my-repo/pulls/234/merge’ -d ‘{
“commit_title”: “test merge by manually calling github API”,
“commit_message”: “Test commit”,
“merge_method”: “merge”
}’ | python -m ‘json.tool’
{
“sha”: “<sha>”,
“merged”: true,
“message”: “Pull Request successfully merged”
}

[Jdmorrisett]

We also have a bot that needs the ability to force an approval and merge PRs. Where can we track this issue/feature request? Is it in a roadmap, ticket, or repo issue somewhere?

Best Regards

[kamigerami]

bump

[pantelis-karamolegkos]

Is it possible however to add github-actions bot to CODEOWNERS?

[lukasz-mitka]

no

[omrizi-tr]

It it possible to add a GitHub app to the CODEOWNERS file?

[filippo-possenti-version1]

I also would find this very useful. Github, you should really look into this.

[TomerFi]

Waiting for this...

[m1n9o]

Eager to see this feature....

[gsuess]

Or at least allow the bot to be added to a team.

[nealajpatel]

The ability to add a github app to a team would be extremely helpful for our use-case given we use CODEOWNERS

[yatharth2307]

We are also looking forward to it. This would be extremely helpful.

[ronballesteros]

We also are using github apps to auto create and approve PRs. We also use CODEOWNERS on our repos and this would be very useful for us.

[saeedseyfi]

Hey @AndreaGriffiths11!
We are also developing a PR review assistant app at Spotify. Allowing the app as codeowner or adding it to a team would be super helpful.
Is there any update regarding this request?

[suryapandian]

Hello
GH actions works like a charm. 👏
However, GH bot not being a codeowner hinders our automation process.

Our org is also working towards an auto approval mechanism for renovate PRs. This would be extremely helpful. Waiting for this 🙇‍♀️

[brettcurtis]

We want to add @coderabbitai to our code owners.

[marin-keeper]

Add your vote here pls https://github.com/orgs/community/discussions/108490

[asos-lewish]

My organisation would also love the ability to allow a GitHub App the ability to approve PRs where branch protection requires a review from CODEOWNERS. Please can we get an idea if this is on your roadmap or how we can track progress on this?

[marin-keeper]

Please help push https://github.com/orgs/community/discussions/108490

[harshita-gupta]

This is a huge limitation in Github Apps, and is preventing us from deprecating old service accounts and migrating them fully to Github Apps.

[marin-keeper]

Please add your vote https://github.com/orgs/community/discussions/108490

[chrislewis-fd]

Is there an ETA on this feature? Its over 4 years old. Does anyone have a solid workaround for this?

[marin-keeper]

Link to the feature request https://github.com/orgs/community/discussions/108490

[LautaroLobo12]

@AndreaGriffiths11 any updates on this? Seems like a common use case that's missing rn

[marin-keeper]

No updates yet, vote here please https://github.com/orgs/community/discussions/108490

[austenstone]

Wouldn't a required status check act as a workaround? Sure you can't require approval for specific files but you could write that logic into your GitHub app and send a successful status check if those files aren't modified.

[BakerNet]

Yes, you can do this as a workaround, but you lose glance value on your PR for other checks. Say you run CI checks - it's nice as a non-bot reviewer to see at a glance the most recent commit is green.

[younsl]

Unfortunately, As of February 2025, this is still not supported.

When attempting to add a bot to the .github/CODEOWNERS file using any of these formats, you'll get an Invalid owner error:

# .github/CODEOWNERS
* app/github-actions
* @github-actions
* @github-actions[bot]

[marin-keeper]

Here's the feat request for you to vote https://github.com/orgs/community/discussions/108490

[Hotpirsch]

We have an automatic PR validation running with Github Actions and it would be very beneficial if we could have the bot as the CODEOWNER because otherwise it happens regularly that some hyperactive user approves and clicks the merge button before the validation has actually finished. If the github-actions bot would be the code owner then that temptation could be avoided. +1

[busy-bee-happy]

This issue is now five years old. Could we please have an update on whether this is taken into consideration at all? It starts to feel a bit like messages are just sent into the void. The workarounds of adding your dependency definitions to the codeowners exclusion list breaks code ownership policies, and personal access tokens where the bot impersonates a real person introduces operational overhead (now token management, offboarding impersonated users). As such, developers refrain from automating dependency management, which introduces risk. Please help us automaters to automate our work, and we'll have more time to automate for the rest of the world.

Thanks very much in advance <3

[marin-keeper]

https://github.com/orgs/community/discussions/108490 is the feature request, please add your vote

[m-perrott]

June 2025, we need an update on this.

[marin-keeper]

Feature request: https://github.com/orgs/community/discussions/108490
Add your vote please :)

[chlos]

We are using Atlantis/Terraform for some of our repos, and we wanted to add Atlantis bot to CODEOWNERS to allow it to merge PRs which met some special requirements. Basically we wanted Atlantis to run some custom policy checks / custom apply scripts to make it's own decision to merge some PRs ingoring the "Require review from Code Owners" branch protection rule.

Apparently adding the bot to the owners list is impossible (yet?). So we found this workaround useful:

• Use Rulesets instead of the Branch protection rules for your repo.
• Add the app to the bypass list.
• Now the app is able to merge PRs ignoring the CODEOWNERS settings.

[anthony-legay]

For those who still wonder, there seem to be a new setting possible now, I don't remember having it previously: "Exempt from rules"

Description seems to fit the requirement, that is completely ignore rules silently and not prompt anything the user to bypass the rules.

[domenico-luciani-deel]

Any news about it? I already added my vote here: https://github.com/orgs/community/discussions/108490 tho :)

[shlomisas]

Guys, in the AI era it's mandatory to have this support, any plans to do it??

[Schwartz-Matthew-bah]

Easy interim solution is to create a service account, add that account to the CODEOWNERS team, and then add an extra step to approve using that account.

[lukasz-mitka]

While this workaround works, there are drawbacks that should be mentioned:

• you have to pay for the extra account
• regular accounts have lower API rate limits

[casey-robertson-paypal]

it is an interim but it's a PITA - PAT rotation/scoping, managing it, paying for and adding the seat etc etc