mirror of
https://github.com/farion1231/cc-switch.git
synced 2026-07-24 21:30:17 +08:00
Jason
468c93d409
- Add CODEOWNERS so PRs to main require owner review (closes the gap where two collaborators could approve each other's changes). - Gate the release job behind a 'release' environment, so signing secrets are only unlocked after manual approval. - Stop ignoring the whole .github directory; this had been silently swallowing labeler.yml and workflows/labeler.yml, which are now tracked. Paired with a tag ruleset (created out-of-band) that restricts creation of v* tags to admins, this prevents a write collaborator from pushing a tag to trigger a signed release build.
15 lines
664 B
Plaintext
15 lines
664 B
Plaintext
# Code owners for cc-switch
|
|
#
|
|
# Branch protection on `main` has "Require review from Code Owners" enabled.
|
|
# With this file present, a PR cannot merge to `main` without an approval from
|
|
# the owner below. This closes the gap where two collaborators could approve
|
|
# each other's malicious PRs (a single non-owner approval is no longer enough).
|
|
|
|
# Global fallback: every PR needs owner approval before merging to main.
|
|
* @farion1231
|
|
|
|
# Most sensitive paths — CI/signing/release and the Rust backend. Listed
|
|
# explicitly so they stay locked even if the global rule above is relaxed later.
|
|
/.github/ @farion1231
|
|
/src-tauri/ @farion1231
|