From 48be8fd13cc90dd1bd14b3639dd953577d4624d7 Mon Sep 17 00:00:00 2001 From: Guillermo Perez Date: Tue, 18 Aug 2026 17:06:23 +0200 Subject: [PATCH] security: expand CODEOWNERS to cover all workflows and actions Add catch-all (*) rule so no future file can land without a codeowner review. Explicitly add app-ci-checks.yml and actions/setup-app/ which were previously uncovered. --- .github/CODEOWNERS | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS index ca4b43a..128fbeb 100644 --- a/.github/CODEOWNERS +++ b/.github/CODEOWNERS @@ -4,14 +4,22 @@ # app code, with the consumer repos' secrets. Paths that change deployment # behavior, use secrets, or govern the security controls require review from # a designated owner. Any listed owner can satisfy the required review. +# +# The catch-all (*) at the top ensures no new file can land without a +# codeowner review; explicit entries below override it where needed. + +# --- Default catch-all --- +* @gpmayorga @hieronx @gregory-kf # --- Deployment behavior & secret usage --- /.github/workflows/app-build-deploy-dev.yml @gpmayorga @hieronx @gregory-kf /.github/workflows/app-build-deploy-release.yml @gpmayorga @hieronx @gregory-kf /.github/workflows/app-promote-production.yml @gpmayorga @hieronx @gregory-kf /.github/workflows/app-rollback.yml @gpmayorga @hieronx @gregory-kf +/.github/workflows/app-ci-checks.yml @gpmayorga @hieronx @gregory-kf /actions/build-app/ @gpmayorga @hieronx @gregory-kf /actions/deploy-app/ @gpmayorga @hieronx @gregory-kf +/actions/setup-app/ @gpmayorga @hieronx @gregory-kf # --- Security controls & governance --- # lib-ci enforces SHA-pinning and lint; .pinact.yaml defines pin exceptions;