Per-path approval and per-group reviewer suggestions #20

	name: Maintainer approval

	on:
	pull_request_target:
	pull_request_review:
	types: [submitted, dismissed]

	defaults:
	run:
	shell: bash

	jobs:
	check:
	runs-on:
	group: databricks-deco-testing-runner-group
	labels: ubuntu-latest-deco
	timeout-minutes: 5
	# Note: team membership resolution in per-path approval requires a token
	# with org:read scope. The default GITHUB_TOKEN may lack this, causing
	# team-based ownership checks to fall back to maintainer approval.
	permissions:
	pull-requests: read
	statuses: write
	steps:
	- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
	with:
	persist-credentials: false
	sparse-checkout: \|
	.github/workflows
	.github/scripts
	.github/OWNERS
	- name: Require core team approval
	uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
	with:
	retries: 3
	script: \|-
	const script = require('./.github/workflows/maintainer-approval.js');
	await script({ context, github, core });

Provide feedback