As mentioned previously somewhere, GitHub has deprecated

dependabot.yml

for configuring Dependabot reviewers and will instead use

CODEOWNERS

. But

CODEOWNERS

has no way to restrict to just Dependabot. Thus, if we had

**/Cargo.toml

and

src/rust/engine/Cargo.lock

in the configuration, then any changes to those files will have the reviewers added, not just Dependabot PRs. This may be fine, but an alternative may be to have an GitHub Actions workflow to assign reviewers instead whenever a Dependabot PR is opened. Thoughts?

So, generally okay with anything here - but one note that might be handy... I've occasionally noticed PRs which languish due to no reviewers, and in some of these cases it might be because the pr creator just doesnt know who to add by default. That might speak to the need for a codeowners too?

And which point we restart the debate over what

CODEOWNERS

should be in general and who is assigned to what.

fair - so i guess the discussion would be more about... do we want automated dependabot reviewers or not. Assuming yes, is there another option excluding codeowners - other than GHA? If GHA is the only real option - seems like the right approach

I also think having no default reviewers would be not-ideal-but-acceptable to avoid extra work. (I think that is how it was for along time)

We wouldn’t need a no reviewers default though. The proposed alternative is a GHA workflow to assign reviewers versus having it done by having configured by

CODEOWNERS