Jason 468c93d409 ci: harden release supply chain ...

- Add CODEOWNERS so PRs to main require owner review (closes the gap
  where two collaborators could approve each other's changes).
- Gate the release job behind a 'release' environment, so signing
  secrets are only unlocked after manual approval.
- Stop ignoring the whole .github directory; this had been silently
  swallowing labeler.yml and workflows/labeler.yml, which are now tracked.

Paired with a tag ruleset (created out-of-band) that restricts creation
of v* tags to admins, this prevents a write collaborator from pushing a
tag to trigger a signed release build.

2026-07-07 16:02:16 +08:00

..

ci.yml

chore(deps): bump pnpm/action-setup from 5 to 6 (#2518)

2026-05-02 09:44:28 +08:00

claude.yml

fix(ci): pin Claude review checkout to PR head sha

2026-05-02 20:33:54 +08:00

labeler.yml

ci: harden release supply chain

2026-07-07 16:02:16 +08:00

release.yml

ci: harden release supply chain

2026-07-07 16:02:16 +08:00

stale.yml

chore(deps): bump actions/stale from 9 to 10 (#2520)

2026-05-02 09:44:36 +08:00