Allow a code owners' PRs to be approved by non-owners

[viettrungluu]

With GitHub's CODEOWNERS, every PR must be reviewed/approved by applicable owners, even when the author of the PR is themself an owner. Traditionally (e.g., with Chromium's and Google's OWNERS), an owner can get approval from anyone (and only needs owners approval for files they don't own).

The request is to allow the looser Chromium/Google system to be followed (at what granularity -- file/repository/branch -- is up for discussion).

Rationale

This is extremely invaluable for onboarding new reviewers/owners. In the Chromium/Google/etc. system, new team members can review owners' code and be useful (there's a social contract on owners ensuring that their code is adequately reviewed; typically, easier/more trivial PRs are sent to new members for review first). In GitHub's system, new team members' reviews are fairly useless until they are made code owners. This leads to new members being made code owners too early without enough onboarding.

Examples

Example 1: If I post a PR for files owned by team A and I'm a member of A:

• with GitHub, I need a member of A to approve
• with Chromium/Google, I still need approval from someone, but not necessarily a member of A (there's a social contract about ensuring that the review is adequate, but since I'm a member of A it should be in my interest to enforce that contract)

Example 2: If I post a PR for files owned by teams A and B and I am a member of A (but not B):

• with GitHub, I still need members of A and B to approve
• with Chromium/Google, I only need a member of B to approve (again, there's a social contract about ensuring that the files owned by A are appropriately reviewed)

[JonZeolla]

Related to this, if you have an item in CODEOWNERS which has only a single team assigned, and that team only has a single member at the moment, and that team member creates a PR, it is impossible to get that PR merged if you require CODEOWNER review without an admin override. With the above proposed solution this issue would also be resolved.

[vayan]

yeah it's pretty annoying to require an admin override :/

[jakerockland]

yeah it's pretty annoying to require an admin override :/

+++, it encourages bad infosec policy practices IMO

[bdrazen]

How has this feature been out since 2017 and not addressed this issue? 😕

[sam-utila]

GitHub is not built for enterprise

[sanchay-hai]

GitHub this practically makes the CODEOWNERs useless. Please fix this