Add codeowner-update agentic workflow

[aaronpowell]

Adds an agentic workflow that triggers when a maintainer comments #codeowner on a pull request.

What it does

• Listens for #codeowner comments on PRs
• Reads the PR's changed files and filters for files in agents/, skills/, instructions/, workflows/, hooks/, and plugins/ directories
• Looks up the PR creator's username
• Creates a new PR against staged that updates the CODEOWNERS file with entries assigning the PR creator as owner of their contributed files
• Posts a confirmation comment on the original PR

Files

• .github/workflows/codeowner-update.md — the agentic workflow definition
• .github/workflows/codeowner-update.lock.yml — compiled lock file

[Copilot]

Pull request overview

Adds a new agentic workflow to automate CODEOWNERS updates when a maintainer triggers it via a #codeowner PR comment, generating a follow-up PR against staged and notifying on the original PR.

Changes:

• Introduces an agentic workflow definition that reacts to issue_comment events containing #codeowner on PRs.
• Adds the compiled gh-aw lock workflow that executes the agent, performs threat detection, and applies safe outputs (create PR + comment).

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 3 comments.

File	Description
.github/workflows/codeowner-update.md	Defines the agent prompt, trigger, and safe outputs for generating a CODEOWNERS-update PR.
.github/workflows/codeowner-update.lock.yml	Compiled workflow implementing the runtime, safety gates, and safe-output handling for the agent.

---

You can also share your feedback on Copilot code review. Take the survey.

[Copilot]

create-pull-request safe output calls must include a branch field, but the workflow instructions never tell the agent to choose/provide one. In this repo’s compiled workflow, the safe-outputs validator marks create_pull_request.branch as required, so omitting it will cause the tool call to fail. Update the instructions to require a deterministic, unique branch name (e.g., derived from PR number and username).

Suggested change

	- **Body:** A summary listing every new or updated CODEOWNERS entry and the PR creator who was assigned ownership.
	- **Body:** A summary listing every new or updated CODEOWNERS entry and the PR creator who was assigned ownership.
	- **Branch:** Set the `branch` field in the `create-pull-request` call to a deterministic, unique name derived from the triggering PR and its creator, for example: `codeowner-update/pr-${{ github.event.issue.number }}-<pr-creator-username>`. Normalize the username by lowercasing it and replacing any non-alphanumeric characters with `-`.

[Copilot]

The instructions say to replace the owner for an existing CODEOWNERS entry when the exact path already exists. This can unintentionally remove existing owners (e.g., /workflows/ @brunoborges in the current CODEOWNERS) and transfer ownership entirely to the PR author. Consider preserving existing owners (append the PR author) or only replacing entries that were previously added by this workflow’s own comment blocks.

Suggested change

	- If an entry for that exact path already exists in CODEOWNERS, **replace** the owner with the PR creator rather than adding a duplicate line.
	- If an entry for that exact path already exists in CODEOWNERS, **preserve all existing owners** and add the PR creator as an additional owner if they are not already listed. You may update a prior `#codeowner` comment block created by this workflow instead of adding a duplicate line, but do not remove any existing owners for that path.

[Copilot]

Other agentic workflows in this repo declare minimal GitHub MCP toolsets (e.g., toolsets: [repos, issues]). Using toolsets: [default] here is less explicit about required capabilities and can make reviews/audits harder. Prefer listing the specific toolsets needed (likely repos, issues, pull_requests, and optionally context).

Suggested change

	toolsets: [default]
	toolsets: [repos, issues, pull_requests, context]