Remove blanket review routing while preserving the explicit owners of the vouch list, workflows, actions, approval helpers, and SBOM check already on main.
Signed-off-by: Jim Meyer <jimeyer@nvidia.com>
Adds the OpenShell / Maintainer Approval status check. It passes only when
someone listed in MAINTAINERS.md has approved the pull request, and it
notifies no one: a required status check is the only native primitive that
enforces who must approve without requesting a review from them.
The job runs on pull_request_review and merge_group with read-only
permissions and posts nothing anywhere; its exit code is the check result.
Both MAINTAINERS.md and the decision helper are read from main via a
sparse checkout, never from the pull request ref, so a contributor cannot
add themselves to the list or rewrite the decision logic and self-approve.
Because pull_request_review runs the pull request's own copy of the
workflow file, CODEOWNERS now covers the whole enforcement surface --
workflows, actions, CODEOWNERS itself, the zizmor config, MAINTAINERS.md,
and the enforcement scripts -- naming the outside collaborators explicitly
alongside the team, since org policy keeps them off GitHub teams. The
ruleset's native code owner requirement is what blocks a merge that
disables the gate, regardless of what the tampered check reports.
Also adds a change-alert workflow that comments the approver-set delta on
pull requests touching MAINTAINERS.md, and documents both in CONTRIBUTING.
Signed-off-by: Jim Meyer <jimeyer@nvidia.com>
Evan Lezar