Merge branch '41914-exempt-specific-files-from-codeowners-rules' into 'master'

Exempt specific files from Codeowners rules

See merge request https://gitlab.com/gitlab-org/gitlab/-/merge_requests/180162



Merged-by: Kerri Miller <kerrizor@kerrizor.com>
Approved-by: Joe Woodward <jwoodward@gitlab.com>
Approved-by: Kerri Miller <kerrizor@kerrizor.com>
Reviewed-by: Kerri Miller <kerrizor@kerrizor.com>
Reviewed-by: Joe Woodward <jwoodward@gitlab.com>
Co-authored-by: Olaoluwa Oluro <olaoluro@gitlab.com>

ee/config/feature_flags/gitlab_com_derisk/codeowners_file_exclusions.yml

+---
+name: codeowners_file_exclusions
+feature_issue_url: https://gitlab.com/gitlab-org/gitlab/-/issues/41914
+introduced_by_url: https://gitlab.com/gitlab-org/gitlab/-/merge_requests/180162
+rollout_issue_url: https://gitlab.com/gitlab-org/gitlab/-/issues/517075
+milestone: '17.9'
+group: group::source code
+type: gitlab_com_derisk
+default_enabled: false

ee/lib/gitlab/code_owners/entry.rb

@@ -5,16 +5,20 @@ module CodeOwners
     class Entry
       include ::Gitlab::Utils::StrongMemoize
 
-      Data = Struct.new(:pattern, :owner_line, :section, :optional, :approvals_required)
+      Data = Struct.new(:pattern, :owner_line, :section, :optional, :approvals_required, :exclusion)
 
       attr_reader :data
       protected :data
 
-      delegate :pattern, :hash, :owner_line, :section, :approvals_required, to: :data
+      delegate :pattern, :hash, :owner_line, :section, :approvals_required, :exclusion, to: :data
 
-      def initialize(pattern, owner_line, section = Section::DEFAULT, optional = false, approvals_required = 0)
-        @data = Data.new(pattern, owner_line, section, optional, approvals_required)
+      # rubocop:disable Metrics/ParameterLists -- TODO: Reduce number of parameters in this method
+      def initialize(
+        pattern, owner_line, section = Section::DEFAULT, optional = false, approvals_required = 0,
+        exclusion = false)
+        @data = Data.new(pattern, owner_line, section, optional, approvals_required, exclusion)
       end
+      # rubocop:enable Metrics/ParameterLists
 
       def all_users(project)
         strong_memoize(:all_users) do
@@ -64,6 +68,10 @@ def optional?
         data.optional
       end
 
+      def exclusion?
+        data.exclusion
+      end
+
       def ==(other)
         return false unless other.is_a?(self.class)
 

ee/lib/gitlab/code_owners/file.rb

@@ -61,11 +61,20 @@ def entries_for_path(path)
         matches = []
 
         parsed_data.each do |_, section_entries|
-          matching_pattern = section_entries.keys.reverse.detect do |pattern|
-            path_matches?(pattern, path)
-          end
+          if Feature.enabled?(:codeowners_file_exclusions, @blob.repository.project)
+            matching_patterns = section_entries.keys.reverse.select { |pattern| path_matches?(pattern, path) }
+            matching_entries = matching_patterns.map { |pattern| section_entries[pattern] }
+
+            next if matching_entries.any?(&:exclusion?)
+
+            matches << matching_entries.first.dup if matching_entries.any?
+          else
+            matching_pattern = section_entries.keys.reverse.detect do |pattern|
+              path_matches?(pattern, path)
+            end
 
-          matches << section_entries[matching_pattern].dup if matching_pattern
+            matches << section_entries[matching_pattern].dup if matching_pattern
+          end
         end
 
         matches
@@ -120,6 +129,12 @@ def get_parsed_data
 
       def parse_entry(line, parsed, section, line_number)
         pattern, _separator, entry_owners = line.partition(/(?<!\\)\s+/)
+
+        if Feature.enabled?(:codeowners_file_exclusions, @blob.repository.project)
+          is_exclusion = pattern.start_with?('!')
+          pattern = pattern[1..] if is_exclusion
+        end
+
         normalized_pattern = normalize_pattern(pattern)
 
         if entry_owners.present? && ReferenceExtractor.new(entry_owners).references.blank?
@@ -130,12 +145,17 @@ def parse_entry(line, parsed, section, line_number)
 
         add_error(Error::MISSING_ENTRY_OWNER, line_number) if owners.blank?
 
-        parsed[section.name][normalized_pattern] = Entry.new(
+        entry_args = [
           pattern,
           owners,
           section.name,
           section.optional,
-          section.approvals)
+          section.approvals
+        ]
+
+        entry_args << is_exclusion if Feature.enabled?(:codeowners_file_exclusions, @blob.repository.project)
+
+        parsed[section.name][normalized_pattern] = Entry.new(*entry_args)
       end
 
       def skip?(line)

ee/spec/lib/gitlab/code_owners/file_spec.rb

@@ -21,6 +21,50 @@ def owner_line(pattern)
       file.parsed_data["codeowners"][pattern].owner_line
     end
 
+    context 'when handling exclusion patterns' do
+      let(:file_content) do
+        <<~CONTENT
+          * @group-x
+          !*.rb
+
+          [Ruby]
+          *.rb @ruby-devs
+          /config/example.yml @config-yml
+          !/config/**/*.rb
+        CONTENT
+      end
+
+      it 'excludes patterns correctly per section' do
+        parsed = file.parsed_data
+
+        expect(parsed['codeowners'].keys).to contain_exactly('/**/*', '/**/*.rb')
+        expect(parsed['codeowners']['/**/*'].owner_line).to eq('@group-x')
+        expect(parsed['codeowners']['/**/*.rb'].exclusion).to be(true)
+
+        expect(parsed['Ruby'].keys).to contain_exactly('/**/*.rb', '/config/example.yml', '/config/**/*.rb')
+        expect(parsed['Ruby']['/**/*.rb'].owner_line).to eq('@ruby-devs')
+        expect(parsed['Ruby']['/config/example.yml'].owner_line).to eq('@config-yml')
+        expect(parsed['Ruby']['/config/**/*.rb'].exclusion).to be(true)
+      end
+
+      context 'when "codeowners_file_exclusions" is disabled' do
+        before do
+          stub_feature_flags(codeowners_file_exclusions: false)
+        end
+
+        it 'does not mark excluded entries per section' do
+          parsed = file.parsed_data
+
+          expect(parsed['codeowners'].keys).to contain_exactly('/**/*', '/**/!*.rb')
+          expect(parsed['codeowners']['/**/*'].owner_line).to eq('@group-x')
+
+          expect(parsed['Ruby'].keys).to contain_exactly('/**/*.rb', '/config/example.yml', '/**/!/config/**/*.rb')
+          expect(parsed['Ruby']['/**/*.rb'].owner_line).to eq('@ruby-devs')
+          expect(parsed['Ruby']['/config/example.yml'].owner_line).to eq('@config-yml')
+        end
+      end
+    end
+
     context "when CODEOWNERS file contains no sections" do
       it 'parses all the required lines' do
         expected_patterns = [
@@ -428,6 +472,76 @@ def owner_line(pattern)
       end
     end
 
+    context 'when handling excluded patterns' do
+      let(:file_content) do
+        <<~CONTENT
+          * @group-x
+          !*.rb
+
+          [Ruby]
+          *.rb @ruby-devs
+          !/config/*
+        CONTENT
+      end
+
+      it 'matches non-excluded files to default owner' do
+        entry = file.entries_for_path('file.txt').first
+
+        expect(entry.owner_line).to eq('@group-x')
+      end
+
+      it 'matches .rb files to ruby owner except in config' do
+        ruby_entry = file.entries_for_path('app/models/user.rb').first
+        config_entry = file.entries_for_path('config/routes.rb')
+
+        expect(ruby_entry.owner_line).to eq('@ruby-devs')
+        expect(config_entry).to be_empty
+      end
+
+      it 'does not match excluded patterns' do
+        entries = file.entries_for_path('config/database.rb')
+
+        expect(entries).to be_empty
+      end
+
+      context 'with nested exclusions' do
+        let(:file_content) do
+          <<~CONTENT
+            * @group-x
+
+            !/app/temp/*
+            !/app/*/temp/*
+          CONTENT
+        end
+
+        it 'handles nested path exclusions correctly' do
+          regular_entry = file.entries_for_path('app/models/user.rb').first
+          temp_entry = file.entries_for_path('app/temp/temp.rb')
+          nested_temp_entry = file.entries_for_path('app/models/temp/file.rb')
+
+          expect(regular_entry.owner_line).to eq('@group-x')
+          expect(temp_entry).to be_empty
+          expect(nested_temp_entry).to be_empty
+        end
+
+        context 'when "codeowners_file_exclusions" is disabled' do
+          before do
+            stub_feature_flags(codeowners_file_exclusions: false)
+          end
+
+          it 'handles nested path exclusions correctly' do
+            regular_entry = file.entries_for_path('app/models/user.rb').first
+            temp_entry = file.entries_for_path('app/temp/temp.rb').first
+            nested_temp_entry = file.entries_for_path('app/models/temp/file.rb').first
+
+            expect(regular_entry.owner_line).to eq('@group-x')
+            expect(temp_entry.owner_line).to eq('@group-x')
+            expect(nested_temp_entry.owner_line).to eq('@group-x')
+          end
+        end
+      end
+    end
+
     context "when CODEOWNERS file contains no sections" do
       it_behaves_like "returns expected matches"
     end