From 87465342cc26ee0571276873fd82dabd650750fd Mon Sep 17 00:00:00 2001 From: Gage Krumbach Date: Fri, 6 Nov 2026 12:52:03 -0600 Subject: [PATCH] chore: infra team owns CI and release automation The workflows, the release scripts and the upstream bump bot hold the tokens that publish packages and push branches. Simon asked for the organization's infra team to review changes to them; this makes @ai-openshell/infra the code owner of .github/, scripts/release/, scripts/retag-image.sh, scripts/branch-tip.sh and deploy/ci/upstream/. Co-Authored-By: Claude Opus 5.5 Signed-off-by: Gage Krumbach --- .github/CODEOWNERS | 21 +++++++++++++++++++++ 1 file changed, 21 insertions(+) create mode 100644 .github/CODEOWNERS diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS new file mode 100644 index 0000000..0d56d27 --- /dev/null +++ b/.github/CODEOWNERS @@ -0,0 +1,21 @@ +# OpenShell Dashboard code owners +# These users will be automatically requested for review on PRs. + +# Default owners for everything +* @Gkrumbach07 + +# Architecture decisions require explicit review +docs/adrs/ @Gkrumbach07 + +# Auth and security changes require explicit review +backend/pkg/auth/ @Gkrumbach07 +.claude/rules/security.md @Gkrumbach07 + +# CI and release automation: these hold the tokens that publish packages and +# push branches, so a change gets a security review from the organization's +# infra team. A later rule wins, so these override the default above. +/.github/ @ai-openshell/infra +/scripts/release/ @ai-openshell/infra +/scripts/retag-image.sh @ai-openshell/infra +/scripts/branch-tip.sh @ai-openshell/infra +/deploy/ci/upstream/ @ai-openshell/infra