GitHub CODEOWNERS and Branch-Protection from a Team Map

Prompt

Act as a GitHub org admin writing CODEOWNERS and branch protection from a team map. You target GitHub.com CODEOWNERS syntax and the branch protection / repository rules REST shape that matches Inputs. You do not invent @org/team slugs, user logins, or required status checks. This is not a CODEOWNERS file for GitLab or Bitbucket unless Inputs say so.
You work only from Inputs. Do not invent stats, citations, quotes, URLs, names, IDs, or records that are not in Inputs.

Inputs:
- Org and default repo: [OrgRepo]
- Default branch name: [Branch]
- Team map (path glob -> GitHub team slug or user): [Map]
- Fallback owners if a path has no team: [Fallback or NONE]
- Required status checks I can prove exist: [Checks or NONE]
- Review count and dismiss-stale setting I want: [Reviews]
- Admin enforcement and linear history flags: [Flags]
- Paths that must not have owners (generated, vendor): [Exclude]
- GitHub plan feature I may use (classic protection vs rulesets): [Mode]
- Words I must not use: [Banned]

Generate:
1. Honesty ledger: org, repo, branch, every team slug and login in Map, every check in Checks. Forbidden: teams and checks not listed.
2. CODEOWNERS file: header comment naming OrgRepo and Branch. One rule per Map row. Exclude paths as unowned comments, not fake teams.
3. Unresolved paths: list globs in Map that point at a team or user not fully specified. Do not invent @org/unknown.
4. Branch protection or ruleset JSON sketch for Mode. Required reviews from Reviews. Required checks only from Checks. If Checks is NONE, omit the checks array rather than inventing CI.
5. Bypass list: only if Flags or Map names bypass actors. Else none.
6. Apply notes: gh or REST endpoints you would call, no invented tokens.
7. Test plan: 5 PR cases (owned path, unowned path, excluded path, admin, stale review) using only Map.
8. Compliance pass: quote Banned words, invented teams, GitLab syntax, required check names not in Checks. Cut them.

Constraints:
- GitHub CODEOWNERS. Do not emit GitLab sections or Bitbucket ownership files.
- Never invent a team slug, user login, or required check.
- If Mode is classic protection, do not use ruleset-only fields. If Mode is rulesets, do not mix classic-only fields.
- Fallback NONE means unmatched paths have no owner; do not assign @org/everyone.
- No emojis.

Instructions

Replace every [bracket] with your details before running. Works on ChatGPT, Claude, and Gemini.

Examples

Example Input

OrgRepo: northwind/pay-api
Branch: main
Map: /src/billing/ -> @northwind/billing-eng; /src/risk/ -> @northwind/risk-eng; /.github/workflows/ -> @northwind/platform; CODEOWNERS -> @northwind/platform; /docs/ -> @jane-ortiz
Fallback: NONE
Checks: pay-api-ci / lint; pay-api-ci / test. No deploy check.
Reviews: 2 approving reviews; dismiss stale reviews true; code owner review true
Flags: enforce admins true; require linear history true; allow force pushes false
Exclude: /src/generated/; /vendor/
Mode: classic branch protection on main (not rulesets)
Banned: optional reviewers, CODEOWNERS optional, skip CI

Example Output

1. Ledger. northwind/pay-api, branch main. Teams: @northwind/billing-eng, @northwind/risk-eng, @northwind/platform. User: @jane-ortiz. Checks: pay-api-ci / lint; pay-api-ci / test. Reviews: 2, dismiss stale, owner review. Flags: enforce admins, linear history, no force push. Exclude generated and vendor. Mode classic. Forbidden: deploy check, @northwind/everyone, ruleset fields, optional reviewers.

2. CODEOWNERS. # northwind/pay-api main. /src/billing/ @northwind/billing-eng. /src/risk/ @northwind/risk-eng. /.github/workflows/ @northwind/platform. CODEOWNERS @northwind/platform. /docs/ @jane-ortiz. # unowned: /src/generated/ /vendor/. No * fallback.

3. Unresolved: none. Every Map row has a slug or login.

4. Classic protection JSON sketch. required_status_checks strict true, contexts [pay-api-ci / lint, pay-api-ci / test]. required_pull_request_reviews required_approving_review_count 2, dismiss_stale_reviews true, require_code_owner_reviews true. enforce_admins true. required_linear_history true. allow_force_pushes false. No required_deployment check.

5. Bypass: none named.

6. Apply. PUT /repos/northwind/pay-api/branches/main/protection with a token the admin already has. Put CODEOWNERS at repo root. Do not print a PAT.

7. Tests. PR under /src/billing/ needs billing-eng. PR under /docs/ needs jane-ortiz. PR under /vendor/ has no owner. Admin push still needs the 2 reviews. Stale approval dismissed after a new commit.

8. Compliance. Cut: optional reviewers, CODEOWNERS optional, skip CI. Gaps: ruleset migration, deploy check, team ids, last-push approval flag.