fix: write CODEOWNERS annotations after glob-based sections

GitHub applies the last matching CODEOWNERS line, but the generator wrote
the file-annotation section first. A file that a team glob excludes via
unowned_globs and an annotation assigns to another team is valid, and
for-file resolves it to the annotated team, yet the broader team glob
came later in CODEOWNERS and won on GitHub (and in --from-codeowners
lookups).

Write the annotations section last. Resolution and validation keep their
existing mapper order; only the generated file changes.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

Author: artfuldodger

src/ownership.rs

@@ -122,7 +122,9 @@ impl Ownership {
         let validator = Validator {
             project: self.project.clone(),
             mappers: self.mappers(),
-            file_generator: FileGenerator { mappers: self.mappers() },
+            file_generator: FileGenerator {
+                mappers: self.codeowners_file_mappers(),
+            },
             executable_name: self.project.executable_name.clone(),
         };
 
@@ -166,7 +168,9 @@ impl Ownership {
     #[instrument(level = "debug", skip_all)]
     pub fn generate_file(&self) -> String {
         info!("generating codeowners file");
-        let file_generator = FileGenerator { mappers: self.mappers() };
+        let file_generator = FileGenerator {
+            mappers: self.codeowners_file_mappers(),
+        };
         file_generator.generate_file()
     }
 
@@ -182,6 +186,20 @@ impl Ownership {
             Box::new(TeamGemMapper::build(self.project.clone())),
         ]
     }
+
+    // GitHub applies the last matching CODEOWNERS line, so annotations are written last: an annotated
+    // file can still match a broader team glob that excludes it through unowned_globs.
+    fn codeowners_file_mappers(&self) -> Vec<Box<dyn Mapper>> {
+        vec![
+            Box::new(TeamGlobMapper::build(self.project.clone())),
+            Box::new(DirectoryMapper::build(self.project.clone())),
+            Box::new(RubyPackageMapper::build(self.project.clone())),
+            Box::new(JavascriptPackageMapper::build(self.project.clone())),
+            Box::new(TeamYmlMapper::build(self.project.clone())),
+            Box::new(TeamGemMapper::build(self.project.clone())),
+            Box::new(TeamFileMapper::build(self.project.clone())),
+        ]
+    }
 }
 
 #[cfg(test)]

tests/annotation_in_unowned_team_glob_test.rs

@@ -0,0 +1,44 @@
+use indoc::indoc;
+use predicates::prelude::*;
+use std::error::Error;
+
+mod common;
+use common::OutputStream;
+use common::run_codeowners;
+
+// Alpha owns ruby/app/**/* but excludes beta_owned.rb through unowned_globs, and Beta owns that file
+// through an annotation. GitHub applies the last matching CODEOWNERS line, so the annotation line must
+// come after Alpha's broader glob for GitHub to agree with for-file.
+const FIXTURE: &str = "annotation_in_unowned_team_glob";
+
+#[test]
+fn test_validate_accepts_generated_order() -> Result<(), Box<dyn Error>> {
+    run_codeowners(FIXTURE, &["validate"], true, OutputStream::Stdout, predicate::eq(""))?;
+    Ok(())
+}
+
+#[test]
+fn test_codeowners_file_agrees_with_for_file() -> Result<(), Box<dyn Error>> {
+    run_codeowners(
+        FIXTURE,
+        &["crosscheck-owners"],
+        true,
+        OutputStream::Stdout,
+        predicate::eq(indoc! {"
+            Success! All files match between CODEOWNERS and for-file command.
+        "}),
+    )?;
+    Ok(())
+}
+
+#[test]
+fn test_for_file_from_codeowners_returns_annotated_owner() -> Result<(), Box<dyn Error>> {
+    run_codeowners(
+        FIXTURE,
+        &["for-file", "--from-codeowners", "ruby/app/services/beta_owned.rb"],
+        true,
+        OutputStream::Stdout,
+        predicate::str::contains("Team: Beta"),
+    )?;
+    Ok(())
+}

tests/executable_name_config_test.rs

@@ -45,15 +45,15 @@ fn test_custom_executable_name_full_error_message() -> Result<(), Box<dyn Error>
     -# Outdated content to trigger validation error
     -/app/old.rb @FooTeam
     +
-    +# Annotations at the top of file
-    +/app/foo.rb @FooTeam
-    +
     +# Team-specific owned globs
     +/ruby/app/payments/** @PaymentTeam
     +
     +# Team YML ownership
     +/config/teams/foo.yml @FooTeam
     +/config/teams/payments.yml @PaymentTeam
+    +
+    +# Annotations at the top of file
+    +/app/foo.rb @FooTeam
 
     CODEOWNERS out of date. Run `bin/codeownership validate` to update the CODEOWNERS file
 
@@ -74,11 +74,11 @@ fn test_default_executable_name_full_error_message() -> Result<(), Box<dyn Error
     The following changes are required (- current, + expected):
     -# Outdated content to trigger validation error
     -/app/old.rb @BarTeam
-    +# Annotations at the top of file
-    +/app/bar.rb @BarTeam
-    +
     +# Team YML ownership
     +/config/teams/bar.yml @BarTeam
+    +
+    +# Annotations at the top of file
+    +/app/bar.rb @BarTeam
 
     CODEOWNERS out of date. Run `codeowners generate` to update the CODEOWNERS file
 

tests/fixtures/annotation_in_unowned_team_glob/.github/CODEOWNERS

@@ -0,0 +1,18 @@
+# STOP! - DO NOT EDIT THIS FILE MANUALLY
+# This file was automatically generated by "bin/codeownership validate".
+#
+# CODEOWNERS is used for GitHub to suggest code/file owners to various GitHub
+# teams. This is useful when developers create Pull Requests since the
+# code/file owner is notified. Reference GitHub docs for more details:
+# https://help.github.com/en/articles/about-code-owners
+
+
+# Team-specific owned globs
+/ruby/app/**/* @AlphaTeam
+
+# Team YML ownership
+/config/teams/alpha.yml @AlphaTeam
+/config/teams/beta.yml @BetaTeam
+
+# Annotations at the top of file
+/ruby/app/services/beta_owned.rb @BetaTeam

tests/fixtures/annotation_in_unowned_team_glob/config/code_ownership.yml

@@ -0,0 +1,4 @@
+owned_globs:
+  - "ruby/**/*.rb"
+team_file_glob:
+  - config/teams/**/*.yml

tests/fixtures/annotation_in_unowned_team_glob/config/teams/alpha.yml

@@ -0,0 +1,7 @@
+name: Alpha
+github:
+  team: '@AlphaTeam'
+owned_globs:
+  - ruby/app/**/*
+unowned_globs:
+  - ruby/app/services/beta_owned.rb

tests/fixtures/annotation_in_unowned_team_glob/config/teams/beta.yml

@@ -0,0 +1,3 @@
+name: Beta
+github:
+  team: '@BetaTeam'

tests/fixtures/annotation_in_unowned_team_glob/ruby/app/services/alpha_owned.rb

@@ -0,0 +1,2 @@
+class AlphaOwned
+end

tests/fixtures/annotation_in_unowned_team_glob/ruby/app/services/beta_owned.rb

@@ -0,0 +1,4 @@
+# @team Beta
+
+class BetaOwned
+end

tests/fixtures/custom_codeowners_path/docs/CODEOWNERS

@@ -7,8 +7,8 @@
 # https://help.github.com/en/articles/about-code-owners
 
 
-# Annotations at the top of file
-/ruby/app/models/test.rb @TestTeam
-
 # Team YML ownership
 /config/teams/test_team.yml @TestTeam
+
+# Annotations at the top of file
+/ruby/app/models/test.rb @TestTeam