Gerrit Code Owners 实战：用 OWNERS 做目录级审批门禁

set -euo pipefail
KIT_BASE_URL="https://blog.treesir.pub/posts/gerrit-code-owners-directory-gate/files"
mkdir -p gerrit-code-owners-lab
cd gerrit-code-owners-lab

curl -fsSLO "$KIT_BASE_URL/SHA256SUMS"
while IFS= read -r manifest_line; do
  if [[ ! $manifest_line =~ ^[0-9a-f]{64}[[:space:]]{2}([A-Za-z0-9._/-]+)$ ]]; then
    echo "Invalid manifest entry: $manifest_line" >&2
    exit 1
  fi

  relative_path=${BASH_REMATCH[1]}
  case "$relative_path" in
    /*|.|..|./*|../*|*/.|*/..|*/./*|*/../*|*//*)
      echo "Unsafe manifest path: $relative_path" >&2
      exit 1
      ;;
  esac

  mkdir -p "$(dirname "$relative_path")"
  curl -fsSL "$KIT_BASE_URL/$relative_path" -o "$relative_path"
done < SHA256SUMS

sha256sum -c SHA256SUMS

[access "refs/heads/*"]
  read = group Registered Users
  push = group Developers

Code-Review = SATISFIED
Verified    = SATISFIED
Code-Owners = UNSATISFIED

[plugin "code-owners"]
  disabled = true
  backend = find-owners
  requiredApproval = Code-Review+1
  overrideApproval = Owners-Override+1
  fallbackCodeOwners = NONE
  enableImplicitApprovals = FALSE
  mergeCommitStrategy = ALL_CHANGED_FILES
  allowedEmailDomain = example.internal

fallbackCodeOwners = NONE

[access "refs/heads/*"]
  label-Owners-Override = 0..+1 group Administrators

[label "Owners-Override"]
  function = NoBlock
  defaultValue = 0
  value = 0 No score
  value = +1 Override

disabledBranch = refs/meta/config

PLUGIN_URL='https://gerrit-ci.gerritforge.com/job/plugin-code-owners-bazel-stable-3.14/6/artifact/bazel-bin/plugins/code-owners/code-owners.jar'
PLUGIN_SHA256='3d7f275efcee227eee8d5b6ae3cb564d62e4b9f4a3981666c868ce81bdb1a9f7'

ALLOWED_EMAIL_DOMAIN=example.internal \
  bash /path/to/files/scripts/install-code-owners.sh

docker compose ps
docker compose logs --since=5m gerrit | grep -E 'code-owners|ERROR|Exception'
docker compose exec -T gerrit \
  sha256sum /var/gerrit/plugins/code-owners.jar

git fetch origin \
  refs/meta/config:refs/remotes/origin/meta-config

git switch -c feat/code-owners-bootstrap \
  origin/meta-config

[codeOwners]
  disabled = true
  disabledBranch = refs/meta/config
  backend = find-owners
  requiredApproval = Code-Review+1
  overrideApproval = Owners-Override+1
  fallbackCodeOwners = NONE
  enableImplicitApprovals = FALSE

[validation "refs/heads/*"]
  enableValidationOnCommitReceived = FORCED
  enableValidationOnSubmit = FORCED
  rejectNonResolvableCodeOwners = true

git add project.config code-owners.config groups
git commit -m "feat: prepare Code Owners safeguards"
git push origin HEAD:refs/for/refs/meta/config

root-owner@example.internal

set noparent

frontend-owner@example.internal

set noparent

backend-owner@example.internal

Developers
Backend-Team

git switch main
git pull --ff-only

git switch -c feat/code-owners-baseline
mkdir -p frontend backend
# Copy and edit the three OWNERS files here.

git add OWNERS frontend/OWNERS backend/OWNERS
git commit -m "feat: add directory ownership baseline"
git push origin HEAD:refs/for/main

disabled = true

disabled = false

enableValidationOnCommitReceived = TRUE
enableValidationOnSubmit = TRUE

git add code-owners.config
git commit -m "feat: enable Code Owners for review project"
git push origin HEAD:refs/for/refs/meta/config

frontend/README.md
backend/README.md

git switch main
git pull --ff-only
git switch -c feat/cross-directory-review

printf '\nFrontend review evidence.\n' >> frontend/README.md
printf '\nBackend review evidence.\n' >> backend/README.md

git add frontend/README.md backend/README.md
git commit -m "docs: update both owned components"
git push origin HEAD:refs/for/main%topic=code-owners-lab

{
  "frontend/README.md": "APPROVED",
  "backend/README.md": "INSUFFICIENT_REVIEWERS"
}

export GERRIT_HTTP_USER='review-admin'
export GERRIT_HTTP_PASSWORD='replace-with-http-password'

curl -fsS \
  --user "$GERRIT_HTTP_USER:$GERRIT_HTTP_PASSWORD" \
  'https://review.example.internal/a/changes/review-project~45/revisions/current/code_owners.status' \
  | sed '1d' \
  | jq .

Code-Review +1

status: MERGED
revision: 9d0a166d616a15412ac034e77281ecb40225f05a
subject: docs: update both owned components

git config user.name
git config user.email
git show -s --format='author=%an <%ae>%ncommitter=%cn <%ce>' HEAD

git config user.name 'review-admin'
git config user.email 'admin@example.internal'
git commit --amend --reset-author --no-edit

rejectNonResolvableCodeOwners = true

disabled = true

Code-Review +2
Verified +1

# Gerrit health
docker compose ps
curl -fsS https://review.example.internal/config/server/version

# Plugin checksum
docker compose exec -T gerrit \
  sha256sum /var/gerrit/plugins/code-owners.jar

# Plugin errors
docker compose logs --since=24h gerrit \
  | grep -E 'code-owners.*(ERROR|Exception)|Failed to load plugin'

[codeOwners]
  disabled = true

data/gerrit_etc/
data/gerrit_plugins/
data/gerrit_git/