Skip to content

ci: CODEOWNERS on workflows so the human-authors gate cannot be silently removed #2816

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
Hugo0 wants to merge 1 commit into
base: dev
Choose a base branch
from
Open

ci: CODEOWNERS on workflows so the human-authors gate cannot be silently removed #2816

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 3 additions & 0 deletions .github/CODEOWNERS
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,3 @@
# Workflow files gate the human-authors policy. A PR that edits them needs a
# code-owner review, so the gate cannot be removed by a PR nobody reads.
/.github/workflows/ @Hugo0

@chip-peanut-bot chip-peanut-bot Bot Aug 27, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

MAJOR: Own the CODEOWNERS policy file

On dev, PR A can delete only .github/CODEOWNERS; line 3 owns only workflows, so GitHub assigns no code owner and the zero-approval ruleset can still merge it. PR B can then remove the human-authors workflow with no code-owner gate. GitHub evaluates ownership from the base branch and recommends owning CODEOWNERS itself. Add /.github/CODEOWNERS @Hugo0 (or own /.github/).

@chip-peanut-bot chip-peanut-bot Bot Aug 27, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

MAJOR: [moonshotai/kimi-k3] CODEOWNERS file itself is unprotected — two-step silent removal still possible

The only rule is /.github/workflows/ @Hugo0, so once 'require code owner review' is enabled on the dev ruleset, a PR touching .github/CODEOWNERS requires no code-owner review. An attacker (or careless contributor) can land PR #1 editing or deleting .github/CODEOWNERS with zero approvals, then PR #2 deleting or neutering the human-authors job in .github/workflows/ merges green — exactly the silent-removal scenario this PR claims to close. Fix: add a rule owning the CODEOWNERS file (and ideally the whole .github/ directory, since workflow-adjacent files like composite actions under .github/actions/ can also alter what the gate executes), e.g. /.github/ @Hugo0 or at minimum /.github/CODEOWNERS @Hugo0, placed after (or instead of) the workflows rule.

Loading