Enforcing CODEOWNERS Approval

Enterprise Edition

CODEOWNERS enforcement via require_completed_reviews is an Enterprise Edition feature. It is included in Hosted SaaS and self-hosted Enterprise deployments. Setting require_completed_reviews: true on the Open Source Edition is not permitted — Terrateam rejects the configuration and posts a comment on the pull request. See Editions.

Terrateam integrates with CODEOWNERS to ensure that infrastructure changes are reviewed and approved by the appropriate teams or individuals before being applied. This is particularly important for maintaining governance and compliance in large organizations where different teams own different parts of the infrastructure.

Configuring CODEOWNERS Enforcement

To enforce CODEOWNERS approval in Terrateam, use the require_completed_reviews option in your apply requirements configuration. This ensures that all required CODEOWNERS have approved the pull request before Terraform changes can be applied.

Basic Configuration

Here’s a basic example that enforces CODEOWNERS approval for all infrastructure changes:

apply_requirements:
  checks:
    - tag_query: ''
      approved:
        enabled: true
        require_completed_reviews: true

With this configuration:

• Terrateam will check that your VCS considers the pull request approved
• If a required CODEOWNERS review is still pending or has requested changes, the apply will be blocked
• The apply can proceed as soon as the CODEOWNERS requirement is satisfied

Terrateam does not parse CODEOWNERS itself. It reads your VCS’s own review verdict for the pull request, which means the apply gate matches the merge gate exactly. In particular, when a path lists more than one owner, an approval from any one of them satisfies both. You never need to restate your CODEOWNERS file in .terrateam/config.yml.

Environment-Specific CODEOWNERS Enforcement

You can use tag queries to enforce CODEOWNERS approval only for specific environments:

apply_requirements:
  checks:
    - tag_query: 'production'
      approved:
        enabled: true
        require_completed_reviews: true
    - tag_query: 'staging'
      approved:
        enabled: true
        require_completed_reviews: false
    - tag_query: 'development'
      approved:
        enabled: false

This configuration:

• Enforces CODEOWNERS approval for production environments
• Allows applies in staging without completed CODEOWNERS reviews
• Allows applies in development without any approval requirements

How It Works

When require_completed_reviews: true is configured:

1. A developer opens a pull request with Terraform changes

2. Your VCS automatically requests reviews from CODEOWNERS based on the files changed

3. When someone runs terrateam apply, Terrateam checks:

   • Whether approval is required based on your configuration
   • Whether your VCS reports the pull request as approved

4. If the VCS reports the pull request as approved, the apply proceeds

5. Otherwise Terrateam blocks the apply, listing any reviews that are still outstanding

Requirements

For the VCS verdict to account for code owners, the branch the pull request targets must have a branch protection rule or ruleset with Require review from Code Owners enabled. Without it, CODEOWNERS still auto-requests reviewers, but the VCS does not treat their approval as mandatory, and neither does Terrateam.

Two cases behave differently:

• The branch requires reviews, but not from code owners. The verdict counts approvals without regard to who gave them, so require_completed_reviews enforces the approval count rather than ownership.
• The branch requires no reviews at all. There is no verdict to read. Terrateam falls back to requiring that no review request on the pull request is still outstanding.

GitLab exposes no equivalent verdict, so on GitLab require_completed_reviews always uses the outstanding-review-request behavior.