chore(ci): add CODEOWNERS for workflows and CODEOWNERS itself (#1472)

9d70aee49b88615917104386fcd4dba07daaaf94 · 2026-05-15 11:33:54 -0700 · Trevin Chow

* chore(ci): add CODEOWNERS to gate edits to workflows and CODEOWNERS itself

Defense in depth alongside the org-level "Approve fork PR workflows for
first-time contributors who are new to GitHub" setting. Workflow files
have access to repo secrets at runtime; CODEOWNERS controls who can edit
the gating rules themselves. Both must require an explicit maintainer
review before merging.

Lists @tmchow and @mvanhorn so bus factor is 2 and a single absence
doesn't block workflow changes.

* chore(ci): extend CODEOWNERS to scripts/ and .github/scripts/

Greptile P1 flagged the gap: workflows run `bash .github/scripts/validate-skill-docs.sh`
and `scripts/golden.sh verify` in steps that have secrets in scope, so an
edit to either script directory has the same exfiltration potential as
editing the workflow YAML. Add both to the gate.

Files touched

A .github/CODEOWNERS

Diff

commit 9d70aee49b88615917104386fcd4dba07daaaf94
Author: Trevin Chow <trevin@trevinchow.com>
Date:   Fri May 15 11:33:54 2026 -0700

    chore(ci): add CODEOWNERS for workflows and CODEOWNERS itself (#1472)
    
    * chore(ci): add CODEOWNERS to gate edits to workflows and CODEOWNERS itself
    
    Defense in depth alongside the org-level "Approve fork PR workflows for
    first-time contributors who are new to GitHub" setting. Workflow files
    have access to repo secrets at runtime; CODEOWNERS controls who can edit
    the gating rules themselves. Both must require an explicit maintainer
    review before merging.
    
    Lists @tmchow and @mvanhorn so bus factor is 2 and a single absence
    doesn't block workflow changes.
    
    * chore(ci): extend CODEOWNERS to scripts/ and .github/scripts/
    
    Greptile P1 flagged the gap: workflows run `bash .github/scripts/validate-skill-docs.sh`
    and `scripts/golden.sh verify` in steps that have secrets in scope, so an
    edit to either script directory has the same exfiltration potential as
    editing the workflow YAML. Add both to the gate.
---
 .github/CODEOWNERS | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS
new file mode 100644
index 00000000..e0025c41
--- /dev/null
+++ b/.github/CODEOWNERS
@@ -0,0 +1,14 @@
+# Code owners for security-sensitive paths.
+# A malicious PR that modifies these paths could exfiltrate secrets at workflow
+# runtime or weaken the merge-gate; require an explicit maintainer review.
+# See: docs.github.com/en/repositories/managing-your-repositorys-settings-and-security/customizing-your-repository/about-code-owners
+#
+# Coverage rationale: anything a workflow can `run:` is effectively part of
+# the workflow's trust boundary. That includes workflow YAML, scripts checked
+# into the repo that workflows invoke, and CODEOWNERS itself (so a malicious
+# PR cannot strip the gate before exploiting it).
+
+.github/workflows/  @tmchow @mvanhorn
+.github/scripts/    @tmchow @mvanhorn
+scripts/            @tmchow @mvanhorn
+.github/CODEOWNERS  @tmchow @mvanhorn

← bd4dc641 fix(cli): kebab-case SKILL.md and README endpoint examples ( · back to Cli Printing Press · fix(cli): populate printer + run_id in generated .printing-p a1098f15 →