mirror of
https://github.com/NVIDIA/OpenShell.git
synced 2026-10-20 06:00:06 +08:00
Jim Meyer
61d42102c1
Adds the OpenShell / Maintainer Approval status check. It passes only when someone listed in MAINTAINERS.md has approved the pull request, and it notifies no one: a required status check is the only native primitive that enforces who must approve without requesting a review from them. The job runs on pull_request_review and merge_group with read-only permissions and posts nothing anywhere; its exit code is the check result. Both MAINTAINERS.md and the decision helper are read from main via a sparse checkout, never from the pull request ref, so a contributor cannot add themselves to the list or rewrite the decision logic and self-approve. Because pull_request_review runs the pull request's own copy of the workflow file, CODEOWNERS now covers the whole enforcement surface -- workflows, actions, CODEOWNERS itself, the zizmor config, MAINTAINERS.md, and the enforcement scripts -- naming the outside collaborators explicitly alongside the team, since org policy keeps them off GitHub teams. The ruleset's native code owner requirement is what blocks a merge that disables the gate, regardless of what the tampered check reports. Also adds a change-alert workflow that comments the approver-set delta on pull requests touching MAINTAINERS.md, and documents both in CONTRIBUTING. Signed-off-by: Jim Meyer <jimeyer@nvidia.com>
36 lines
2.0 KiB
Plaintext
36 lines
2.0 KiB
Plaintext
## Broad ownership — core team reviews everything
|
|
* @NVIDIA/openshell-codeowners @mrunalp @sjenning @derekwaynecarr
|
|
|
|
## Vouch list — maintainers only (bot commits bypass, but manual edits need review)
|
|
.github/VOUCHED.td @NVIDIA/openshell-codeowners
|
|
|
|
## Merge enforcement — these paths decide who can merge, so they notify the full
|
|
# list of maintainers to raise scrutiny on changes here.
|
|
#
|
|
# PR checks run local to the branch, so unless the check specifically avoids
|
|
# using branch-local files, a PR could change its own gates and appear to pass
|
|
# them. Covering the required checks here closes that gap.
|
|
#
|
|
# The whole workflows directory is covered, not just the approval gate, because
|
|
# any workflow can claim a required check context or ask for a broader token.
|
|
#
|
|
# Normally, we'd use a GitHub team to cover all maintainers, but org-level
|
|
# policies prevent outside collaborators from being on a GH team at this time
|
|
# so we spell them out explicitly.
|
|
|
|
# Core check mechanisms
|
|
/.github/workflows/ @NVIDIA/openshell-codeowners @mrunalp @sjenning @derekwaynecarr
|
|
/.github/actions/ @NVIDIA/openshell-codeowners @mrunalp @sjenning @derekwaynecarr
|
|
/.github/CODEOWNERS @NVIDIA/openshell-codeowners @mrunalp @sjenning @derekwaynecarr
|
|
/.github/zizmor.yml @NVIDIA/openshell-codeowners @mrunalp @sjenning @derekwaynecarr
|
|
|
|
# `MAINTAINERS.md` maintainer approval checks
|
|
/MAINTAINERS.md @NVIDIA/openshell-codeowners @mrunalp @sjenning @derekwaynecarr
|
|
/tasks/scripts/check_maintainer_approval.py @NVIDIA/openshell-codeowners @mrunalp @sjenning @derekwaynecarr
|
|
/tasks/scripts/alert_maintainer_change.py @NVIDIA/openshell-codeowners @mrunalp @sjenning @derekwaynecarr
|
|
/tasks/scripts/check_maintainer_approval_test.py @NVIDIA/openshell-codeowners @mrunalp @sjenning @derekwaynecarr
|
|
/tasks/scripts/alert_maintainer_change_test.py @NVIDIA/openshell-codeowners @mrunalp @sjenning @derekwaynecarr
|
|
|
|
# Auditable SBOM check
|
|
/tasks/scripts/verify-image-sbom.sh @NVIDIA/openshell-codeowners @mrunalp @sjenning @derekwaynecarr
|