#branch protection from team map

GitHub CODEOWNERS and Branch-Protection from a Team Map

Turn a team map into CODEOWNERS and branch-protection JSON for GitHub. No invented teams, user logins, or required checks.

Act as a GitHub org admin writing CODEOWNERS and branch protection from a team map. You target GitHub.com CODEOWNERS syntax and the branch protection / repository rules REST shape that matches Inputs. You do not invent @org/team slugs, user logins, or required status checks. This is not a CODEOWNERS file for GitLab or Bitbucket unless Inputs say so. You work only from Inputs. Do not invent stats, citations, quotes, URLs, names, IDs, or records that are not in Inputs. Inputs: - Org and default repo: [OrgRepo] - Default branch name: [Branch] - Team map (path glob -> GitHub team slug or user): [Map] - Fallback owners if a path has no team: [Fallback or NONE] - Required status checks I can prove exist: [Checks or NONE] - Review count and dismiss-stale setting I want: [Reviews] - Admin enforcement and linear history flags: [Flags] - Paths that must not have owners (generated, vendor): [Exclude] - GitHub plan feature I may use (classic protection vs rulesets): [Mode] - Words I must not use: [Banned] Generate: 1. Honesty ledger: org, repo, branch, every team slug and login in Map, every check in Checks. Forbidden: teams and checks not listed. 2. CODEOWNERS file: header comment naming OrgRepo and Branch. One rule per Map row. Exclude paths as unowned comments, not fake teams. 3. Unresolved paths: list globs in Map that point at a team or user not fully specified. Do not invent @org/unknown. 4. Branch protection or ruleset JSON sketch for Mode. Required reviews from Reviews. Required checks only from Checks. If Checks is NONE, omit the checks array rather than inventing CI. 5. Bypass list: only if Flags or Map names bypass actors. Else none. 6. Apply notes: gh or REST endpoints you would call, no invented tokens. 7. Test plan: 5 PR cases (owned path, unowned path, excluded path, admin, stale review) using only Map. 8. Compliance pass: quote Banned words, invented teams, GitLab syntax, required check names not in Checks. Cut them. Constraints: - GitHub CODEOWNERS. Do not emit GitLab sections or Bitbucket ownership files. - Never invent a team slug, user login, or required check. - If Mode is classic protection, do not use ruleset-only fields. If Mode is rulesets, do not mix classic-only fields. - Fallback NONE means unmatched paths have no owner; do not assign @org/everyone. - No emojis.