Fix duplicate Code Owners checks on PRs

When both pull_request_target and pull_request_review triggers are in
the same workflow, GitHub creates separate check contexts for each
event type. This causes two 'Code Owners' checks to appear on PRs —
one from the initial PR event (often stale/failing) and one from the
review event (current/passing).

Split the workflow into two files:
- codeowners.yml: keeps only the pull_request_target trigger and runs
  the actual codeowners-plus evaluation
- rerun_codeowners.yml: triggered by pull_request_review, re-runs the
  existing check job via the GitHub API instead of creating a new one

This ensures only a single Code Owners check appears on each PR.

Also skip codeowners-plus evaluation for Version Packages PRs
(changeset-release/main) which only need wrangler team approval and
are already protected by native GitHub CODEOWNERS.

Author: petebacondarwin

.github/workflows/codeowners.yml

@@ -1,6 +1,8 @@
 name: "Code Owners"
 
-# Re-evaluate when PRs are opened/updated, and when reviews are submitted/dismissed.
+# Re-evaluate when PRs are opened/updated.
+# When reviews are submitted/dismissed, the separate rerun_codeowners.yml workflow
+# re-runs this check (rather than creating a second check context).
 # Using pull_request_target (not pull_request) so the workflow has access to secrets
 # for fork PRs. This is safe because:
 #   - The checkout is the BASE branch (ownership rules come from the protected branch)
@@ -9,8 +11,6 @@ name: "Code Owners"
 on:
   pull_request_target:
     types: [opened, reopened, synchronize, ready_for_review, labeled, unlabeled]
-  pull_request_review:
-    types: [submitted, dismissed]
 
 concurrency:
   group: codeowners-${{ github.event.pull_request.number }}
@@ -27,16 +27,19 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: "Checkout Base Branch"
+        if: github.event.pull_request.head.ref != 'changeset-release/main'
         uses: actions/checkout@v4
         with:
           fetch-depth: 0
 
       - name: "Fetch PR Head (for diff computation)"
+        if: github.event.pull_request.head.ref != 'changeset-release/main'
         run: git fetch origin +refs/pull/${{ github.event.pull_request.number }}/head
         env:
           GITHUB_TOKEN: "${{ secrets.CODEOWNERS_GITHUB_PAT }}"
 
       - name: "Codeowners Plus"
+        if: github.event.pull_request.head.ref != 'changeset-release/main'
         uses: multimediallc/codeowners-plus@ff02aa993a92e8efe01642916d0877beb9439e9f # v1.9.0
         with:
           github-token: "${{ secrets.CODEOWNERS_GITHUB_PAT }}"

.github/workflows/rerun_codeowners.yml

@@ -0,0 +1,40 @@
+name: "Rerun Code Owners"
+
+# When a review is submitted or dismissed, re-run the Code Owners check from the
+# main codeowners.yml workflow (triggered by pull_request_target) rather than
+# running the check again under a separate event context. This avoids duplicate
+# "Code Owners" checks appearing on the PR.
+on:
+  pull_request_review:
+    types: [submitted, dismissed]
+
+permissions: {}
+
+jobs:
+  rerun-codeowners:
+    name: "Rerun Codeowners Plus"
+    runs-on: ubuntu-latest
+    permissions:
+      actions: write
+      checks: read
+    steps:
+      - name: "Re-run Codeowners Check"
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          HEAD_REF: ${{ github.event.pull_request.head.ref }}
+          REPO: ${{ github.repository }}
+        run: |
+          # Find the "Run Codeowners Plus" check run for the PR head branch
+          # and extract the Actions job ID from its details URL.
+          job_id=$(gh api "repos/${REPO}/commits/${HEAD_REF}/check-runs" \
+            --jq '.check_runs[] | select(.name == "Run Codeowners Plus") | .details_url' \
+            | head -1 \
+            | grep -oE '[0-9]+$')
+
+          if [ -n "$job_id" ]; then
+            gh api "repos/${REPO}/actions/jobs/${job_id}/rerun" --method POST \
+              || echo "Job may already be running"
+            echo "Re-triggered 'Run Codeowners Plus' (job ${job_id})"
+          else
+            echo "Check 'Run Codeowners Plus' not found for ref ${HEAD_REF}"
+          fi