Automate adding collaborators based on PR modified changes

[sethmlarson]

Currently GHSA doesn't automatically add CODEOWNERS to GHSAs when that code is modified. This bot can do this for us automatically by:

• When a GHSA PR is modified
• Run the changed filenames against the CPython CODEOWNERS for the main branch
• If there are matches, add those users to the collaborating_users / collaborating_teams field in the GHSA

[encukou]

I'm not sure we should open embargoed issues to CODEOWNERS.
The mechanism can be used just to get GitHub notifications about a given file; it doesn't necessarily imply actual “ownership”.

Maybe we should instead assign existing PSRT members according to CODEOWNERS? (and get more people on PSRT of course)

[sethmlarson]

@encukou @hugovk Maybe this needs some clarification about what it means to be in the CODEOWNERs, because my read is that these are the folks we'd be adding manually to a GHSA collaborators in case we were looking for reviews (akin to the Experts Index with an opt-in to being assigned to issues).

[encukou]

what it means to be in the CODEOWNERs

It gets you assigned on PRs that touch the file. What that means is up to the individual -- some ignore it entirely, some treat it as a task list and carefully unassign themselves if they don't want to review something.

If you wanted to assign yourself to all files (*), I don't think you'd get complaints.

[hugovk]

It gets you assigned on PRs that touch the file.

Nit-pick: requests a review, not assigns. End result is pretty similar (ping and attach).

If you wanted to assign yourself to all files (*), I don't think you'd get complaints.

This is more-or-less happening to Adam via Doc/whatsnew/!