500e6bd0ec
* fix(workflows): standardize runner configuration for security jobs * ci(actionlint): add Blacksmith runner label to config Add blacksmith-2vcpu-ubuntu-2404 to actionlint self-hosted-runner labels config to suppress "unknown label" warnings during workflow linting. This label is used across all workflows after the Blacksmith migration. * fix(actionlint): adjust indentation for self-hosted runner labels * feat(security): enhance security workflow with CodeQL analysis steps * fix(security): update CodeQL action to version 4 for improved analysis * fix(security): remove duplicate permissions in security workflow * fix(security): revert CodeQL action to v3 for stability The v4 version was causing workflow file validation failures. Reverting to proven v3 version that is working on main branch. * fix(security): remove duplicate permissions causing workflow validation failure The permissions block had duplicate security-events and actions keys, which caused YAML validation errors and prevented workflow execution. Fixes: workflow file validation failures on main branch * fix(security): remove pull_request trigger to reduce costs * fix(security): restore PR trigger but skip codeql on PRs * fix(security): resolve YAML syntax error in security workflow * refactor(security): split CodeQL into dedicated scheduled workflow * fix(security): update workflow name to Rust Package Security Audit * fix(codeql): remove push trigger, keep schedule and on-demand only * feat(codeql): add CodeQL configuration file to ignore specific paths * Potential fix for code scanning alert no. 39: Hard-coded cryptographic value Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> * fix(ci): resolve auto-response workflow merge markers * fix(build): restore ChannelMessage reply_target usage * ci(workflows): run workflow sanity on workflow pushes for all branches * ci(workflows): rename auto-response workflow to PR Auto Responder * ci(workflows): require owner approval for workflow file changes --------- Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
28 lines
785 B
Text
28 lines
785 B
Text
# Default owner for all files
|
|
* @theonlyhennygod
|
|
|
|
# High-risk surfaces
|
|
/src/security/** @willsarg
|
|
/src/runtime/** @theonlyhennygod
|
|
/src/memory/** @theonlyhennygod
|
|
/.github/** @theonlyhennygod
|
|
/Cargo.toml @theonlyhennygod
|
|
/Cargo.lock @theonlyhennygod
|
|
|
|
# CI
|
|
/.github/workflows/** @theonlyhennygod @willsarg
|
|
/.github/codeql/** @willsarg
|
|
/.github/dependabot.yml @willsarg
|
|
|
|
# Docs & governance
|
|
/docs/** @chumyin
|
|
/AGENTS.md @chumyin
|
|
/CONTRIBUTING.md @chumyin
|
|
/docs/pr-workflow.md @chumyin
|
|
/docs/reviewer-playbook.md @chumyin
|
|
/docs/ci-map.md @chumyin
|
|
|
|
# Security / CI-CD governance overrides (last-match wins)
|
|
/SECURITY.md @willsarg
|
|
/docs/actions-source-policy.md @willsarg @chumyin
|
|
/docs/ci-map.md @willsarg @chumyin
|