From 2f0ee6b5cbc72c9c6af57e84aa04e3903dd2d7ae Mon Sep 17 00:00:00 2001 From: OdevMatheus Date: Mon, 9 Nov 2026 10:51:06 -0300 Subject: [PATCH] ci(security): enforce global codeowners coverage and main branch ruleset Add global wildcard (* @OdevMatheus) ownership in .github/CODEOWNERS so every repository path requires maintainer review, paired with main branch ruleset enforcement for CODEOWNERS approval, stale review dismissal, and required CI status checks. Closes #189 --- .github/CODEOWNERS | 3 +++ CHANGELOG.md | 1 + 2 files changed, 4 insertions(+) diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS index 7541ce9..6fe22a0 100644 --- a/.github/CODEOWNERS +++ b/.github/CODEOWNERS @@ -1,6 +1,9 @@ # CODEOWNERS — Auto-requests maintainer review on critical repository paths. # Last matching pattern wins. +# Global default owner (every file and directory requires maintainer review) +* @OdevMatheus + # Repository documentation & core governance /README*.md @OdevMatheus /.gitignore @OdevMatheus diff --git a/CHANGELOG.md b/CHANGELOG.md index 4dfb28f..7a4af85 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -19,6 +19,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 - **`env-secrets-guard` skill (`arch-quality`):** Detects hardcoded credentials, `.env` files tracked by git, and `.env` files missing from `.gitignore` through the stdlib-only [`scan_secrets.py`](./catalog/arch-quality/env-secrets-guard/scripts/scan_secrets.py) (`--json`, exit codes `0`/`1`/`2`, secrets redacted in output). ### Changed +- **Mandatory `CODEOWNERS` Gate & Main Branch Ruleset Hardening (`#189`):** Expanded [`.github/CODEOWNERS`](./.github/CODEOWNERS) with a global `* @OdevMatheus` rule and hardened the `Protect main branch` GitHub Ruleset (`#26051946`) to enforce `require_code_owner_review: true`, `dismiss_stale_reviews_on_push: true`, and required CI/CodeQL status checks before merging. - **CI/CD & CodeQL Default Branch Alignment (`#188`):** Updated [`.github/workflows/ai-ci.yml`](./.github/workflows/ai-ci.yml), [`.github/workflows/codeql.yml`](./.github/workflows/codeql.yml), [`.github/workflows/release-drafter.yml`](./.github/workflows/release-drafter.yml), [`.github/ISSUE_TEMPLATE/feature_request.yml`](./.github/ISSUE_TEMPLATE/feature_request.yml), [`AGENTS.md`](./AGENTS.md), and [`CONTRIBUTING.md`](./CONTRIBUTING.md) to trigger and reference `main` instead of `master`. ### Removed