ci: harden release supply chain

mirror of https://github.com/farion1231/cc-switch.git synced 2026-08-04 19:45:34 +08:00

- Add CODEOWNERS so PRs to main require owner review (closes the gap
  where two collaborators could approve each other's changes).
- Gate the release job behind a 'release' environment, so signing
  secrets are only unlocked after manual approval.
- Stop ignoring the whole .github directory; this had been silently
  swallowing labeler.yml and workflows/labeler.yml, which are now tracked.

Paired with a tag ruleset (created out-of-band) that restricts creation
of v* tags to admins, this prevents a write collaborator from pushing a
tag to trigger a signed release build.

This commit is contained in:

Jason

2026-07-07 16:02:16 +08:00

parent 525346188b

commit 468c93d409

5 changed files with 106 additions and 1 deletions

.gitignore

-1

View File

@@ -28,5 +28,4 @@ flatpak-repo/
 copilot-api
 .history
 CODEBUDDY.md
 .github
 mainWindow.js