mirror of
https://github.com/NVIDIA/OpenShell.git
synced 2026-10-21 06:11:31 +08:00
Evan Lezar
2ffc3d2b4d
Evaluate issue acceptance using trusted default-branch code and the PR author's repository permissions. Report the native workflow job result, protect enforcement files, and align PR creation and review guidance. Closes #4339 Signed-off-by: Evan Lezar <elezar@nvidia.com>
40 lines
2.2 KiB
Plaintext
40 lines
2.2 KiB
Plaintext
# No wildcard rule. The maintainer-approval workflow checks maintainer reviews.
|
|
# Explicit ownership below protects the review and CI machinery.
|
|
|
|
## Vouch list — maintainers only (bot commits bypass, but manual edits need review)
|
|
.github/VOUCHED.td @NVIDIA/openshell-codeowners
|
|
|
|
## Merge enforcement — these paths decide who can merge, so they notify the full
|
|
# list of maintainers to raise scrutiny on changes here.
|
|
#
|
|
# PR checks run local to the branch, so unless the check specifically avoids
|
|
# using branch-local files, a PR could change its own gates and appear to pass
|
|
# them. Covering the required checks here closes that gap.
|
|
#
|
|
# The whole workflows directory is covered, not just the approval gate, because
|
|
# any workflow can claim a required check context or ask for a broader token.
|
|
#
|
|
# Normally, we'd use a GitHub team to cover all maintainers, but org-level
|
|
# policies prevent outside collaborators from being on a GH team at this time
|
|
# so we spell them out explicitly.
|
|
|
|
# Core check mechanisms
|
|
/.github/workflows/ @NVIDIA/openshell-codeowners @mrunalp @sjenning @derekwaynecarr
|
|
/.github/actions/ @NVIDIA/openshell-codeowners @mrunalp @sjenning @derekwaynecarr
|
|
/.github/CODEOWNERS @NVIDIA/openshell-codeowners @mrunalp @sjenning @derekwaynecarr
|
|
/.github/zizmor.yml @NVIDIA/openshell-codeowners @mrunalp @sjenning @derekwaynecarr
|
|
|
|
# `MAINTAINERS.md` maintainer approval checks
|
|
/MAINTAINERS.md @NVIDIA/openshell-codeowners @mrunalp @sjenning @derekwaynecarr
|
|
/tasks/scripts/check_maintainer_approval.py @NVIDIA/openshell-codeowners @mrunalp @sjenning @derekwaynecarr
|
|
/tasks/scripts/alert_maintainer_change.py @NVIDIA/openshell-codeowners @mrunalp @sjenning @derekwaynecarr
|
|
/tasks/scripts/check_maintainer_approval_test.py @NVIDIA/openshell-codeowners @mrunalp @sjenning @derekwaynecarr
|
|
/tasks/scripts/alert_maintainer_change_test.py @NVIDIA/openshell-codeowners @mrunalp @sjenning @derekwaynecarr
|
|
|
|
# PR issue acceptance checks
|
|
/tasks/scripts/check_issue_acceptance.cjs @NVIDIA/openshell-codeowners @mrunalp @sjenning @derekwaynecarr
|
|
/tasks/scripts/check_issue_acceptance.test.cjs @NVIDIA/openshell-codeowners @mrunalp @sjenning @derekwaynecarr
|
|
|
|
# Auditable SBOM check
|
|
/tasks/scripts/verify-image-sbom.sh @NVIDIA/openshell-codeowners @mrunalp @sjenning @derekwaynecarr
|