Add block on pending codeowner reviews branch protection

Naxdy · Naxdy · commit ff327156ef8d · 2026-01-23T16:02:16.000+01:00
diff --git a/models/git/protected_branch.go b/models/git/protected_branch.go
@@ -56,6 +56,7 @@ type ProtectedBranch struct {
 	RequiredApprovals             int64    `xorm:"NOT NULL DEFAULT 0"`
 	BlockOnRejectedReviews        bool     `xorm:"NOT NULL DEFAULT false"`
 	BlockOnOfficialReviewRequests bool     `xorm:"NOT NULL DEFAULT false"`
+	BlockOnCodeownerReviews       bool     `xorm:"NOT NULL DEFAULT false"`
 	BlockOnOutdatedBranch         bool     `xorm:"NOT NULL DEFAULT false"`
 	DismissStaleApprovals         bool     `xorm:"NOT NULL DEFAULT false"`
 	IgnoreStaleApprovals          bool     `xorm:"NOT NULL DEFAULT false"`
diff --git a/models/migrations/migrations.go b/models/migrations/migrations.go
@@ -400,6 +400,7 @@ func prepareMigrationTasks() []*migration {
 		newMigration(323, "Add support for actions concurrency", v1_26.AddActionsConcurrency),
 		newMigration(324, "Fix closed milestone completeness for milestones with no issues", v1_26.FixClosedMilestoneCompleteness),
 		newMigration(325, "Fix missed repo_id when migrate attachments", v1_26.FixMissedRepoIDWhenMigrateAttachments),
+		newMigration(326, "Add block on codeowner reviews branch protection", v1_26.AddBlockOnCodeownerReviews),
 	}
 	return preparedMigrations
 }
diff --git a/models/migrations/v1_26/v326.go b/models/migrations/v1_26/v326.go
@@ -0,0 +1,16 @@
+// Copyright 2025 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package v1_26
+
+import (
+	"xorm.io/xorm"
+)
+
+func AddBlockOnCodeownerReviews(x *xorm.Engine) error {
+	type ProtectedBranch struct {
+		BlockOnCodeownerReviews bool `xorm:"NOT NULL DEFAULT false"`
+	}
+
+	return x.Sync(new(ProtectedBranch))
+}
diff --git a/modules/structs/repo_branch.go b/modules/structs/repo_branch.go
@@ -58,6 +58,7 @@ type BranchProtection struct {
 	ApprovalsWhitelistTeams       []string `json:"approvals_whitelist_teams"`
 	BlockOnRejectedReviews        bool     `json:"block_on_rejected_reviews"`
 	BlockOnOfficialReviewRequests bool     `json:"block_on_official_review_requests"`
+	BlockOnCodeownerReviews       bool     `json:"block_on_codeowner_reviews"`
 	BlockOnOutdatedBranch         bool     `json:"block_on_outdated_branch"`
 	DismissStaleApprovals         bool     `json:"dismiss_stale_approvals"`
 	IgnoreStaleApprovals          bool     `json:"ignore_stale_approvals"`
@@ -98,6 +99,7 @@ type CreateBranchProtectionOption struct {
 	ApprovalsWhitelistTeams       []string `json:"approvals_whitelist_teams"`
 	BlockOnRejectedReviews        bool     `json:"block_on_rejected_reviews"`
 	BlockOnOfficialReviewRequests bool     `json:"block_on_official_review_requests"`
+	BlockOnCodeownerReviews       bool     `json:"block_on_codeowner_reviews"`
 	BlockOnOutdatedBranch         bool     `json:"block_on_outdated_branch"`
 	DismissStaleApprovals         bool     `json:"dismiss_stale_approvals"`
 	IgnoreStaleApprovals          bool     `json:"ignore_stale_approvals"`
@@ -131,6 +133,7 @@ type EditBranchProtectionOption struct {
 	ApprovalsWhitelistTeams       []string `json:"approvals_whitelist_teams"`
 	BlockOnRejectedReviews        *bool    `json:"block_on_rejected_reviews"`
 	BlockOnOfficialReviewRequests *bool    `json:"block_on_official_review_requests"`
+	BlockOnCodeownerReviews       *bool    `json:"block_on_codeowner_reviews"`
 	BlockOnOutdatedBranch         *bool    `json:"block_on_outdated_branch"`
 	DismissStaleApprovals         *bool    `json:"dismiss_stale_approvals"`
 	IgnoreStaleApprovals          *bool    `json:"ignore_stale_approvals"`
diff --git a/options/locale/locale_en-US.json b/options/locale/locale_en-US.json
@@ -1808,6 +1808,7 @@
   "repo.pulls.blocked_by_outdated_branch": "This pull request is blocked because it's outdated.",
   "repo.pulls.blocked_by_changed_protected_files_1": "This pull request is blocked because it changes a protected file:",
   "repo.pulls.blocked_by_changed_protected_files_n": "This pull request is blocked because it changes protected files:",
+  "repo.pulls.blocked_by_codeowners": "This pull request is missing approval from one or more code owners.",
   "repo.pulls.can_auto_merge_desc": "This pull request can be merged automatically.",
   "repo.pulls.cannot_auto_merge_desc": "This pull request cannot be merged automatically due to conflicts.",
   "repo.pulls.cannot_auto_merge_helper": "Merge manually to resolve the conflicts.",
@@ -2430,6 +2431,8 @@
   "repo.settings.block_on_official_review_requests_desc": "Merging will not be possible when it has official review requests, even if there are enough approvals.",
   "repo.settings.block_outdated_branch": "Block merge if pull request is outdated",
   "repo.settings.block_outdated_branch_desc": "Merging will not be possible when head branch is behind base branch.",
+  "repo.settings.block_on_codeowner_reviews" : "Require approval from code owners",
+  "repo.settings.block_on_codeowner_reviews_desc" : "Merging will only be possible if at least one code owner per code owner rule has given an approving review.",
   "repo.settings.block_admin_merge_override": "Administrators must follow branch protection rules",
   "repo.settings.block_admin_merge_override_desc": "Administrators must follow branch protection rules and cannot circumvent it.",
   "repo.settings.default_branch_desc": "Select a default repository branch for pull requests and code commits:",
diff --git a/routers/api/v1/repo/branch.go b/routers/api/v1/repo/branch.go
@@ -930,6 +930,10 @@ func EditBranchProtection(ctx *context.APIContext) {
 		protectBranch.BlockOnOfficialReviewRequests = *form.BlockOnOfficialReviewRequests
 	}
 
+	if form.BlockOnCodeownerReviews != nil {
+		protectBranch.BlockOnCodeownerReviews = *form.BlockOnCodeownerReviews
+	}
+
 	if form.DismissStaleApprovals != nil {
 		protectBranch.DismissStaleApprovals = *form.DismissStaleApprovals
 	}
diff --git a/routers/web/repo/issue_view.go b/routers/web/repo/issue_view.go
@@ -952,6 +952,7 @@ func preparePullViewReviewAndMerge(ctx *context.Context, issue *issues_model.Iss
 		ctx.Data["ProtectedBranch"] = pb
 		ctx.Data["IsBlockedByApprovals"] = !issues_model.HasEnoughApprovals(ctx, pb, pull)
 		ctx.Data["IsBlockedByRejection"] = issues_model.MergeBlockedByRejectedReview(ctx, pb, pull)
+		ctx.Data["IsBlockedByCodeowners"] = !issue_service.HasAllRequiredCodeownerReviews(ctx, pb, pull)
 		ctx.Data["IsBlockedByOfficialReviewRequests"] = issues_model.MergeBlockedByOfficialReviewRequests(ctx, pb, pull)
 		ctx.Data["IsBlockedByOutdatedBranch"] = issues_model.MergeBlockedByOutdatedBranch(pb, pull)
 		ctx.Data["GrantedApprovals"] = issues_model.GetGrantedApprovalsCount(ctx, pb, pull)
diff --git a/routers/web/repo/setting/protected_branch.go b/routers/web/repo/setting/protected_branch.go
@@ -253,6 +253,7 @@ func SettingsProtectedBranchPost(ctx *context.Context) {
 	}
 	protectBranch.BlockOnRejectedReviews = f.BlockOnRejectedReviews
 	protectBranch.BlockOnOfficialReviewRequests = f.BlockOnOfficialReviewRequests
+	protectBranch.BlockOnCodeownerReviews = f.BlockOnCodeownerReviews
 	protectBranch.DismissStaleApprovals = f.DismissStaleApprovals
 	protectBranch.IgnoreStaleApprovals = f.IgnoreStaleApprovals
 	protectBranch.RequireSignedCommits = f.RequireSignedCommits
diff --git a/services/convert/convert.go b/services/convert/convert.go
@@ -189,6 +189,7 @@ func ToBranchProtection(ctx context.Context, bp *git_model.ProtectedBranch, repo
 		ApprovalsWhitelistTeams:       approvalsWhitelistTeams,
 		BlockOnRejectedReviews:        bp.BlockOnRejectedReviews,
 		BlockOnOfficialReviewRequests: bp.BlockOnOfficialReviewRequests,
+		BlockOnCodeownerReviews:       bp.BlockOnCodeownerReviews,
 		BlockOnOutdatedBranch:         bp.BlockOnOutdatedBranch,
 		DismissStaleApprovals:         bp.DismissStaleApprovals,
 		IgnoreStaleApprovals:          bp.IgnoreStaleApprovals,
diff --git a/services/forms/repo_form.go b/services/forms/repo_form.go
@@ -184,6 +184,7 @@ type ProtectBranchForm struct {
 	ApprovalsWhitelistTeams       string
 	BlockOnRejectedReviews        bool
 	BlockOnOfficialReviewRequests bool
+	BlockOnCodeownerReviews       bool
 	BlockOnOutdatedBranch         bool
 	DismissStaleApprovals         bool
 	IgnoreStaleApprovals          bool
diff --git a/services/issue/pull.go b/services/issue/pull.go
@@ -8,6 +8,7 @@ import (
 	"fmt"
 	"slices"
 
+	git_model "code.gitea.io/gitea/models/git"
 	issues_model "code.gitea.io/gitea/models/issues"
 	org_model "code.gitea.io/gitea/models/organization"
 	user_model "code.gitea.io/gitea/models/user"
@@ -30,38 +31,33 @@ func IsCodeOwnerFile(f string) bool {
 	return slices.Contains(codeOwnerFiles, f)
 }
 
-func PullRequestCodeOwnersReview(ctx context.Context, pr *issues_model.PullRequest) ([]*ReviewRequestNotifier, error) {
-	if err := pr.LoadIssue(ctx); err != nil {
-		return nil, err
-	}
-	issue := pr.Issue
-	if pr.IsWorkInProgress(ctx) {
-		return nil, nil
-	}
+// Get all code owner rules for a given pr + repo combination. Will return nil in case the repo is a fork or no rules exist.
+func getCodeOwnerRules(ctx context.Context, repo *git.Repository, pr *issues_model.PullRequest) ([]*issues_model.CodeOwnerRule, error) {
 	if err := pr.LoadHeadRepo(ctx); err != nil {
 		return nil, err
 	}
+
 	if err := pr.LoadBaseRepo(ctx); err != nil {
 		return nil, err
 	}
+
+	if err := pr.LoadIssue(ctx); err != nil {
+		return nil, err
+	}
+
 	pr.Issue.Repo = pr.BaseRepo
 
 	if pr.BaseRepo.IsFork {
 		return nil, nil
 	}
 
-	repo, err := gitrepo.OpenRepository(ctx, pr.BaseRepo)
-	if err != nil {
-		return nil, err
-	}
-	defer repo.Close()
-
 	commit, err := repo.GetBranchCommit(pr.BaseRepo.DefaultBranch)
 	if err != nil {
 		return nil, err
 	}
 
 	var data string
+
 	for _, file := range codeOwnerFiles {
 		if blob, err := commit.GetBlobByPath(file); err == nil {
 			data, err = blob.GetBlobContent(setting.UI.MaxDisplayFileSize)
@@ -70,6 +66,8 @@ func PullRequestCodeOwnersReview(ctx context.Context, pr *issues_model.PullReque
 			}
 		}
 	}
+
+	// no code owner file = no one to approve
 	if data == "" {
 		return nil, nil
 	}
@@ -79,33 +77,154 @@ func PullRequestCodeOwnersReview(ctx context.Context, pr *issues_model.PullReque
 		return nil, nil
 	}
 
+	return rules, nil
+}
+
+// Get the matching code owner rules for a given pr + repo combination. Will return nil in case no rules matching rules exist.
+func getMatchingCodeOwnerRules(ctx context.Context, repo *git.Repository, pr *issues_model.PullRequest) ([]*issues_model.CodeOwnerRule, error) {
+	rules, err := getCodeOwnerRules(ctx, repo, pr)
+	if err != nil {
+		return nil, err
+	}
+	if rules == nil {
+		return nil, nil
+	}
+
 	// get the mergebase
 	mergeBase, err := gitrepo.MergeBase(ctx, pr.BaseRepo, git.BranchPrefix+pr.BaseBranch, pr.GetGitHeadRefName())
 	if err != nil {
 		return nil, err
 	}
+
 	// https://github.com/go-gitea/gitea/issues/29763, we need to get the files changed
 	// between the merge base and the head commit but not the base branch and the head commit
 	changedFiles, err := repo.GetFilesChangedBetween(mergeBase, pr.GetGitHeadRefName())
 	if err != nil {
 		return nil, err
 	}
 
-	uniqUsers := make(map[int64]*user_model.User)
-	uniqTeams := make(map[string]*org_model.Team)
+	matchingRules := make([]*issues_model.CodeOwnerRule, 0)
+
 	for _, rule := range rules {
 		for _, f := range changedFiles {
 			if (rule.Rule.MatchString(f) && !rule.Negative) || (!rule.Rule.MatchString(f) && rule.Negative) {
-				for _, u := range rule.Users {
-					uniqUsers[u.ID] = u
-				}
-				for _, t := range rule.Teams {
-					uniqTeams[fmt.Sprintf("%d/%d", t.OrgID, t.ID)] = t
-				}
+				matchingRules = append(matchingRules, rule)
+				break
 			}
 		}
 	}
 
+	return matchingRules, nil
+}
+
+func HasAllRequiredCodeownerReviews(ctx context.Context, pb *git_model.ProtectedBranch, pr *issues_model.PullRequest) bool {
+	if !pb.BlockOnCodeownerReviews {
+		return true
+	}
+
+	if err := pr.LoadBaseRepo(ctx); err != nil {
+		return false
+	}
+
+	repo, err := gitrepo.OpenRepository(ctx, pr.BaseRepo)
+	if err != nil {
+		return true
+	}
+
+	defer repo.Close()
+
+	matchingRules, err := getMatchingCodeOwnerRules(ctx, repo, pr)
+	if err != nil {
+		return false
+	}
+	if len(matchingRules) == 0 {
+		return true
+	}
+
+	approvingReviews, err := issues_model.FindLatestReviews(ctx, issues_model.FindReviewOptions{
+		Types:   []issues_model.ReviewType{issues_model.ReviewTypeApprove},
+		IssueID: pr.IssueID,
+	})
+	if err != nil {
+		return false
+	}
+
+	hasApprovals := true
+
+	for _, rule := range matchingRules {
+		ruleReviewers := slices.Clone(rule.Users)
+		for _, t := range rule.Teams {
+			if err := t.LoadMembers(ctx); err != nil {
+				return false
+			}
+
+			ruleReviewers = slices.AppendSeq(ruleReviewers, slices.Values(t.Members))
+		}
+
+		// we need at least 1 code owner that isn't the PR author
+		hasPotentialReviewers := slices.ContainsFunc(ruleReviewers, func(elem *user_model.User) bool { return elem.ID != pr.Issue.PosterID })
+
+		if !hasPotentialReviewers {
+			continue
+		}
+
+		// then we need at least 1 approving review from any valid code owner for this rule
+		hasRuleApproval := slices.ContainsFunc(ruleReviewers, func(elem *user_model.User) bool {
+			return slices.ContainsFunc(approvingReviews, func(review *issues_model.Review) bool {
+				return review.ReviewerID == elem.ID
+			})
+		})
+
+		if !hasRuleApproval {
+			hasApprovals = false
+			break
+		}
+	}
+
+	return hasApprovals
+}
+
+func PullRequestCodeOwnersReview(ctx context.Context, pr *issues_model.PullRequest) ([]*ReviewRequestNotifier, error) {
+	if err := pr.LoadIssue(ctx); err != nil {
+		return nil, err
+	}
+	issue := pr.Issue
+	if pr.IsWorkInProgress(ctx) {
+		return nil, nil
+	}
+
+	if err := pr.LoadBaseRepo(ctx); err != nil {
+		return nil, err
+	}
+
+	pr.Issue.Repo = pr.BaseRepo
+
+	repo, err := gitrepo.OpenRepository(ctx, pr.BaseRepo)
+	if err != nil {
+		return nil, err
+	}
+
+	defer repo.Close()
+
+	matchingRules, err := getMatchingCodeOwnerRules(ctx, repo, pr)
+	if err != nil {
+		return nil, err
+	}
+	if len(matchingRules) == 0 {
+		return nil, nil
+	}
+
+	uniqUsers := make(map[int64]*user_model.User)
+	uniqTeams := make(map[string]*org_model.Team)
+	for _, rule := range matchingRules {
+		for _, u := range rule.Users {
+			uniqUsers[u.ID] = u
+		}
+		for _, t := range rule.Teams {
+			uniqTeams[fmt.Sprintf("%d/%d", t.OrgID, t.ID)] = t
+		}
+	}
+
 	notifiers := make([]*ReviewRequestNotifier, 0, len(uniqUsers)+len(uniqTeams))
 
 	if err := issue.LoadPoster(ctx); err != nil {
diff --git a/services/pull/merge.go b/services/pull/merge.go
@@ -598,6 +598,10 @@ func CheckPullBranchProtections(ctx context.Context, pr *issues_model.PullReques
 		return util.ErrorWrap(ErrNotReadyToMerge, "The head branch is behind the base branch")
 	}
 
+	if !issue_service.HasAllRequiredCodeownerReviews(ctx, pb, pr) {
+		return util.ErrorWrap(ErrNotReadyToMerge, "There are missing code owner reviews.")
+	}
+
 	if skipProtectedFilesCheck {
 		return nil
 	}
diff --git a/templates/repo/issue/view_content/pull_merge_box.tmpl b/templates/repo/issue/view_content/pull_merge_box.tmpl
@@ -18,6 +18,7 @@
 	{{- else if .IsBlockedByApprovals}}red
 	{{- else if .IsBlockedByRejection}}red
 	{{- else if .IsBlockedByOfficialReviewRequests}}red
+	{{- else if .IsBlockedByCodeowners}}red
 	{{- else if .IsBlockedByOutdatedBranch}}red
 	{{- else if .IsBlockedByChangedProtectedFiles}}red
 	{{- else if and .EnableStatusCheck (or $requiredStatusCheckState.IsFailure $requiredStatusCheckState.IsError)}}red
@@ -132,6 +133,11 @@
 						{{svg "octicon-x"}}
 					{{ctx.Locale.Tr "repo.pulls.blocked_by_official_review_requests"}}
 					</div>
+				{{else if .IsBlockedByCodeowners}}
+					<div class="item">
+						{{svg "octicon-x"}}
+					{{ctx.Locale.Tr "repo.pulls.blocked_by_codeowners"}}
+					</div>
 				{{else if .IsBlockedByOutdatedBranch}}
 					<div class="item">
 						{{svg "octicon-x"}}
@@ -168,7 +174,7 @@
 					</div>
 				{{end}}
 
-				{{$notAllOverridableChecksOk := or .IsBlockedByApprovals .IsBlockedByRejection .IsBlockedByOfficialReviewRequests .IsBlockedByOutdatedBranch .IsBlockedByChangedProtectedFiles (and .EnableStatusCheck (not $requiredStatusCheckState.IsSuccess))}}
+				{{$notAllOverridableChecksOk := or .IsBlockedByApprovals .IsBlockedByRejection .IsBlockedByOfficialReviewRequests .IsBlockedByCodeowners .IsBlockedByOutdatedBranch .IsBlockedByChangedProtectedFiles (and .EnableStatusCheck (not $requiredStatusCheckState.IsSuccess))}}
 
 				{{/* admin can merge without checks, writer can merge when checks succeed */}}
 				{{$canMergeNow := and (or (and (not $.ProtectedBranch.BlockAdminMergeOverride) $.IsRepoAdmin) (not $notAllOverridableChecksOk)) (or (not .AllowMerge) (not .RequireSigned) .WillSign)}}
@@ -338,6 +344,11 @@
 						{{svg "octicon-x"}}
 						{{ctx.Locale.Tr "repo.pulls.blocked_by_official_review_requests"}}
 					</div>
+					{{else if .IsBlockedByCodeowners}}
+					<div class="item text red">
+						{{svg "octicon-x"}}
+						{{ctx.Locale.Tr "repo.pulls.blocked_by_codeowners"}}
+					</div>
 				{{else if .IsBlockedByOutdatedBranch}}
 					<div class="item text red">
 						{{svg "octicon-x"}}
diff --git a/templates/repo/settings/protected_branch.tmpl b/templates/repo/settings/protected_branch.tmpl
diff --git a/templates/swagger/v1_json.tmpl b/templates/swagger/v1_json.tmpl

Original file line number	Diff line number	Diff line change
`@@ -400,6 +400,7 @@ func prepareMigrationTasks() []*migration {`
`400`	`400`	`newMigration(323, "Add support for actions concurrency", v1_26.AddActionsConcurrency),`
`401`	`401`	`newMigration(324, "Fix closed milestone completeness for milestones with no issues", v1_26.FixClosedMilestoneCompleteness),`
`402`	`402`	`newMigration(325, "Fix missed repo_id when migrate attachments", v1_26.FixMissedRepoIDWhenMigrateAttachments),`
	`403`	`+ newMigration(326, "Add block on codeowner reviews branch protection", v1_26.AddBlockOnCodeownerReviews),`
`403`	`404`	`}`
`404`	`405`	`return preparedMigrations`
`405`	`406`	`}`
Original file line number	Diff line number	Diff line change
`@@ -930,6 +930,10 @@ func EditBranchProtection(ctx *context.APIContext) {`
`930`	`930`	`protectBranch.BlockOnOfficialReviewRequests = *form.BlockOnOfficialReviewRequests`
`931`	`931`	`}`
`932`	`932`
	`933`	`+ if form.BlockOnCodeownerReviews != nil {`
	`934`	`+ protectBranch.BlockOnCodeownerReviews = *form.BlockOnCodeownerReviews`
	`935`	`+ }`
	`936`	`+`
`933`	`937`	`if form.DismissStaleApprovals != nil {`
`934`	`938`	`protectBranch.DismissStaleApprovals = *form.DismissStaleApprovals`
`935`	`939`	`}`
Original file line number	Diff line number	Diff line change
`@@ -253,6 +253,7 @@ func SettingsProtectedBranchPost(ctx *context.Context) {`
`253`	`253`	`}`
`254`	`254`	`protectBranch.BlockOnRejectedReviews = f.BlockOnRejectedReviews`
`255`	`255`	`protectBranch.BlockOnOfficialReviewRequests = f.BlockOnOfficialReviewRequests`
	`256`	`+ protectBranch.BlockOnCodeownerReviews = f.BlockOnCodeownerReviews`
`256`	`257`	`protectBranch.DismissStaleApprovals = f.DismissStaleApprovals`
`257`	`258`	`protectBranch.IgnoreStaleApprovals = f.IgnoreStaleApprovals`
`258`	`259`	`protectBranch.RequireSignedCommits = f.RequireSignedCommits`