Replace CODEOWNERS with /merge command

.github/workflows/merge.yml

@@ -0,0 +1,33 @@
+name: Merge
+
+on:
+  issue_comment:
+    types: [created]
+
+permissions:
+  contents: write
+  pull-requests: write
+
+jobs:
+  merge:
+    runs-on: ubuntu-latest
+    if: >
+      github.event.issue.pull_request &&
+      github.event.comment.body == '/merge'
+    steps:
+      - uses: actions/checkout@v6
+      - run: npm install js-yaml
+
+      - name: Verify actor is authorized
+        uses: actions/github-script@v9
+        with:
+          script: |
+            const verifyMerge = require('./scripts/verify-merge.js');
+            await verifyMerge({ github, context });
+
+      - name: Merge PR
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          PR_NUMBER: ${{ github.event.issue.number }}
+        run: |
+          gh pr merge "$PR_NUMBER" --squash --auto

CONTRIBUTING.md

@@ -9,11 +9,10 @@ that address issues outside the core GraphQL specifications.
   ([@graphql/gaps-editors](https://github.com/orgs/graphql/teams/gaps-editors)),
   approved by the TSC to administer the GAP program.
 - **Sponsor** — an _editor_ assigned to a GAP who is responsible for approving
-  the initial contents. A _sponsor_ may also be an _author_.
+  and merging the initial contents. A _sponsor_ may also be an _author_.
 - **Author** — a person (or people) who have made significant contributions to a
-  GAP, listed in the `authors` field of `metadata.yml`. _Authors_ are given
-  commit access via `CODEOWNERS` to merge their own and others' submissions to
-  the GAP.
+  GAP, listed in the `authors` field of `metadata.yml`. _Authors_ can merge PRs
+  that only touch their GAP directory (see [Merging](#merging) below).
 
 ## GAP Numbering
 
@@ -62,9 +61,6 @@ gauge public interest, but doing so is not necessary.
 Once approved by the _authors_ and _sponsor_, the PR should be merged by the
 _sponsor_.
 
-`CODEOWNERS` will automatically be updated allowing _authors_ to merge future
-contributions to their GAP.
-
 > [!IMPORTANT]
 > GAP numbers never change. If a proposal needs significant changes, create a
 > new GAP and deprecate the old one.
@@ -126,6 +122,12 @@ The _sponsor_ of a GAP is responsible for ensuring changes to the GAP are
 approved by the _authors_ before merging, though this task may also be performed
 by the TSC. The _authors_ are responsible for guiding contribution to the GAP.
 
+### Merging
+
+PRs that only modify files within a single `gaps/GAP-N/` directory can be merged
+by any _author_ listed in that directory's `metadata.yml` by commenting `/merge`
+on the PR.
+
 ### Versioning
 
 To release a version of a GAP, copy the current `DRAFT.md` into a `versions`

package.json

@@ -12,8 +12,7 @@
     "suggest:format": "echo \"\nTo resolve this, run: $(tput bold)npm run format$(tput sgr0)\" && exit 1",
     "test:format": "prettier --check . || npm run suggest:format",
     "test:spelling": "cspell \"spec/**/*.md\" README.md LICENSE.md",
-    "test:structure": "find ./gaps -maxdepth 1 -type d -name 'GAP-*' | xargs -I{} ./scripts/validate-structure.js {}",
-    "sync:codeowners": "node scripts/sync-codeowners.js"
+    "test:structure": "find ./gaps -maxdepth 1 -type d -name 'GAP-*' | xargs -I{} ./scripts/validate-structure.js {}"
   },
   "devDependencies": {
     "@mlarah/spec-md": "^3.1.0",

scripts/verify-merge.js

@@ -0,0 +1,32 @@
+const fs = require("fs");
+const yaml = require("js-yaml");
+
+module.exports = async ({ github, context }) => {
+  const actor = context.payload.comment.user.login;
+  const prNumber = context.issue.number;
+
+  const { data: files } = await github.rest.pulls.listFiles({
+    ...context.repo,
+    pull_number: prNumber,
+  });
+
+  const gapDirs = files
+    .map((f) => f.filename)
+    .map((p) => p.split("/").slice(0, 2).join("/"));
+
+  const gapsChanged = [...new Set(gapDirs)];
+
+  if (gapsChanged.length !== 1 || !gapsChanged[0].match(/^gaps\/GAP-\d+$/)) {
+    throw new Error("You can only run /merge for PRs that touch exactly one GAP directory and nothing else.");
+  }
+
+  const metadata = yaml.load(fs.readFileSync(`${gapsChanged[0]}/metadata.yml`, "utf8"));
+  const authorizedMergers = new Set([
+    ...metadata.authors.map(author => author.githubUsername.replace(/^@/, '')),
+    metadata.sponsor.replace(/^@/, ''),
+  ]);
+
+  if (!authorizedMergers.has(actor)) {
+    throw new Error(`${actor} is not authorized to merge ${gapsChanged[0]}.`);
+  }
+};