ci: harden release supply chain

mirror of https://github.com/farion1231/cc-switch.git synced 2026-07-24 12:44:18 +08:00

- Add CODEOWNERS so PRs to main require owner review (closes the gap
  where two collaborators could approve each other's changes).
- Gate the release job behind a 'release' environment, so signing
  secrets are only unlocked after manual approval.
- Stop ignoring the whole .github directory; this had been silently
  swallowing labeler.yml and workflows/labeler.yml, which are now tracked.

Paired with a tag ruleset (created out-of-band) that restricts creation
of v* tags to admins, this prevents a write collaborator from pushing a
tag to trigger a signed release build.

This commit is contained in:

Jason

2026-07-07 16:02:16 +08:00

parent 525346188b

commit 468c93d409

5 changed files with 106 additions and 1 deletions

									
										.github/workflows/release.yml
									
		+1
		
												View File
												
				@@ -15,6 +15,7 @@ concurrency:

				jobs:

				  release:

				    runs-on: ${{ matrix.os }}

				    environment: release

				    strategy:

				      fail-fast: false

				      matrix: