Files
Jason 468c93d409 ci: harden release supply chain
- Add CODEOWNERS so PRs to main require owner review (closes the gap
  where two collaborators could approve each other's changes).
- Gate the release job behind a 'release' environment, so signing
  secrets are only unlocked after manual approval.
- Stop ignoring the whole .github directory; this had been silently
  swallowing labeler.yml and workflows/labeler.yml, which are now tracked.

Paired with a tag ruleset (created out-of-band) that restricts creation
of v* tags to admins, this prevents a write collaborator from pushing a
tag to trigger a signed release build.
2026-07-07 16:02:16 +08:00

75 lines
1.8 KiB
YAML

# Configuration for actions/labeler v5
# Automatically labels PRs based on changed file paths
frontend:
- changed-files:
- any-glob-to-any-file:
- "src/**"
- "index.html"
- "vite.config.ts"
- "vitest.config.ts"
- "tailwind.config.cjs"
- "postcss.config.cjs"
- "tsconfig.json"
- "tsconfig.node.json"
- "components.json"
- "tests/**"
backend:
- changed-files:
- any-glob-to-any-file:
- "src-tauri/**"
i18n:
- changed-files:
- any-glob-to-any-file:
- "src/locales/**"
actions:
- changed-files:
- any-glob-to-any-file:
- ".github/**"
dependencies:
- changed-files:
- any-glob-to-any-file:
- "package.json"
- "pnpm-lock.yaml"
- "pnpm-workspace.yaml"
- "src-tauri/Cargo.toml"
- "src-tauri/Cargo.lock"
documentation:
- changed-files:
- any-glob-to-any-file:
- "*.md"
- "docs/**"
- "LICENSE"
mcp:
- changed-files:
- any-glob-to-any-file:
- "src/components/mcp/**"
- "src/lib/api/mcp.ts"
- "src-tauri/src/mcp/**"
- "src-tauri/src/claude_mcp.rs"
- "src-tauri/src/gemini_mcp.rs"
- "src-tauri/src/commands/mcp.rs"
skills:
- changed-files:
- any-glob-to-any-file:
- "src/components/skills/**"
- "src/lib/api/skills.ts"
- "src-tauri/src/commands/skill.rs"
- "src-tauri/src/services/skill.rs"
- "src-tauri/src/database/dao/skills.rs"
proxy:
- changed-files:
- any-glob-to-any-file:
- "src/components/proxy/**"
- "src/lib/api/proxy.ts"
- "src-tauri/src/proxy/**"
- "src-tauri/src/commands/proxy.rs"