arXiv:2512.05551v3 Announce Type: replace Abstract: Code ownership is central to ensuring accountability and maintaining quality in large-scale software development. Yet, as software supply chain attacks threaten project health and quality assurance, mechanisms for assigning and enforcing responsibility have become critical. In 2017, GitHub introduced the CODEOWNERS feature, a file in the repository that names the developers responsible for specific files and automatically requests them as reviewers, to strengthen accountability and protect critical parts of the codebase. Little is known about how CODEOWNERS is adopted and practiced. We present the first large-scale empirical study of CODEOWNERS usage across over 844,000 pull requests with 1.9 million comments and over 2 million reviews. We identify 10,287 designated owners, the developers named in CODEOWNERS files, track their code review activities, and compare them with contribution-based owners, the developers who contributed at least 5% of a file's lines. Results indicate that designated owners take part in a moderate share of the pull requests that touch their files, that their collaborative behavior resembles that of contribution-based owners, and that after adoption merge time and review effort grow more slowly, or fall, relative to their pre-adoption trend. Using regression discontinuity design analysis, we further find that designated owners' review, decision (approval and merge), and authoring activity jumps upward at adoption, and that over the following year they do more review and decision work per pull request than before, whereas contribution-based owners do less review work per pull request. Our results position CODEOWNERS as a promising yet sparsely adopted mechanism for improving software governance and resilience. We discuss how projects can leverage this alternative ownership method to enhance security and accountability in open-source development.
Continue to arXiv Software Engineering →You are being forwarded in 6s — stay on this page