This GitHub Actions workflow automatically migrates reviewers from your .github/dependabot.yml file to the CODEOWNERS.

Dependabot is removing the reviewers feature which can be replaced by CODEOWNERS file. This action workflow facilitates easier transition from reviewers to CODEOWNERS based reviewers management.

• One step migration: Migrate reviewers permissions with single action run
• Manual Trigger: Runs on-demand via workflow_dispatch

Place actions workflow file at .github/workflows/sync-dependabot-reviewers.yml in your repository.

1. Go to Actions tab in your GitHub repository
2. Select "Migrate Dependabot Reviewers to CODEOWNERS" workflow
3. Click "Run workflow"
4. The workflow will create a PR if changes are needed

The workflow needs:

• contents: write - to update CODEOWNERS file
• pull-requests: write - to create pull requests

Solution: Ensure your dependabot.yml has reviewers sections defined for the package ecosystems you want to sync.

Solution: Make sure .github/dependabot.yml exists in your repository.

This is normal: The workflow only creates PRs when there are actual changes to make.

If action migration PR is already open, changes are made to open PR instead of creating new PR

Bash script to migrate Dependabot reviewers from .github/dependabot.yml to CODEOWNERS file. Works with Windows, Linux, Solaris, macOS, BSD etc (requires bash support to work).

1. Download and place script migrate-dependabot-reviewers.sh in your repository root folder
2. Run script: ./migrate-dependabot-reviewers.sh
3. Script will update existing CODEOWNERS or generate a new file if required
4. Review, commit and push CODEOWNERS file

1. Navigate to repository root folder in Bash and execute following commands:

2. Review, commit and push CODEOWNERS file

• bash shell (only requirement - available on all target platforms)

Input (dependabot.yml):

Command:

Output (CODEOWNERS):

Input (dependabot.yml):

Generated CODEOWNERS:

Problem: Script cannot find the dependabot configuration Solutions:

1. Ensure you're in the repository root
2. Check that .github/dependabot.yml exists
3. Verify file permissions

Problem: No reviewers sections in dependabot.yml Solutions:

1. Add reviewers: sections to your dependabot.yml
2. Verify YAML syntax is correct
3. Check that updates have reviewers defined

For users who prefer to migrate reviewers manually without using any scripts or automated tools, this section provides step-by-step instructions to convert your dependabot.yml reviewers to CODEOWNERS entries.

1. Open your repository's .github/dependabot.yml file
2. Create or open the CODEOWNERS file in one of these locations:
   • CODEOWNERS (repository root)
   • .github/CODEOWNERS
   • docs/CODEOWNERS

Look for sections with reviewers in your dependabot.yml:

For each package ecosystem, identify the specific manifest files it manages:

Transform the directory value from dependabot.yml to CODEOWNERS patterns:

Ensure all reviewers have the @ prefix:

• "frontend-team" → @frontend-team
• "alice" → @alice
• "@already-formatted" → @already-formatted (no change)

Combine the directory path + manifest file + reviewers:

Formula: [directory]/[manifest-file] [reviewers...]

Given this dependabot.yml:

Step-by-step conversion:

1. npm in /frontend with reviewers "frontend-team", "alice":

   /frontend/package.json @frontend-team @alice /frontend/package-lock.json @frontend-team @alice /frontend/npm-shrinkwrap.json @frontend-team @alice /frontend/yarn.lock @frontend-team @alice /frontend/pnpm-lock.yaml @frontend-team @alice

2. bundler in / with reviewers "backend-team":

   /Gemfile @backend-team /Gemfile.lock @backend-team /*.gemspec @backend-team

3. docker in /api with reviewers "devops-team":

   /api/Dockerfile @devops-team /api/Dockerfile.* @devops-team /api/*.dockerfile @devops-team

Final CODEOWNERS file:

• Add a header comment to identify the Dependabot section
• Sort patterns logically: root files first, then by directory depth
• Test your patterns by creating a test file and checking GitHub's code owners
• Use consistent formatting with spaces between patterns and reviewers

• Missing @ prefix on reviewer names
• Incorrect glob patterns (use *.ext not **.ext for single directory)
• Wrong directory separators (use / even on Windows)
• Forgetting manifest files specific to each ecosystem

dependabot.yml:

Manual CODEOWNERS entries:

dependabot.yml:

Manual CODEOWNERS entries:

dependabot.yml:

Manual CODEOWNERS entries:

After manually creating your CODEOWNERS entries:

• All reviewer names have @ prefix
• Directory paths start with /
• Patterns match the correct manifest files for each ecosystem
• No duplicate entries for the same file
• Entries are sorted logically (root patterns first)
• File is saved in correct location (CODEOWNERS, .github/CODEOWNERS, or docs/CODEOWNERS)

Dependabot team