Issue with CODEOWNERS and Dependabot assignment of pull requests

[tcelestino]

Select Topic Area

Question

Body

We extensively use CODEOWNERS to configure the team responsible for various repositories. Since all pull requests are assigned to the team, when the Dependabot creates a pull request, it is automatically assigned as well. The problem arises when some individuals are removed from the team, yet the Dependabot continues to be assigned to their pull requests. What's even more peculiar is that this behavior only occurs with pull requests created by the Dependabot.

This raises the following debate:

• Does CODEOWNERS still retain ownership even after someone is removed from the team?
• Is there a way to remove users assigned for review in the Dependabot process?

[carogalvin]

@tcelestino you can configure assignees for Dependabot pull requests via the dependabot.yml file in the .github folder in your repo: https://docs.github.com/en/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file#assignees

[tcelestino]

@carogalvin I already use the configuration. In this case, I use @team_name as "assignees." The problem is that even after leaving the team, I continue to receive notifications that I have been mentioned in pull requests.

Should I change settings to use individual member names instead of the team name?

[carogalvin]

@tcelestino that sounds like the team handle needs to be updated, rather than this being a problem with Dependabot.

[tcelestino]

@carogalvin even after leaving the team, I'm still receiving notifications. I manually removed my user from some old pull requests that Dependabot had assigned to me. Let's see what happens.