Add CODEOWNERS to protected files set by Copilot · Pull Request #22821 · github/gh-aw

Copilot · 2026-03-25T02:40:19Z

CODEOWNERS was only incidentally protected via the .github/ path prefix, leaving root-level CODEOWNERS and docs/CODEOWNERS unprotected.

Changes

pkg/workflow/runtime_definitions.go: Introduces securityConfigFiles — a dedicated slice for security-sensitive repo config files matched by basename. CODEOWNERS is the first entry. getAllManifestFiles() now appends this slice so all three valid placements (CODEOWNERS, .github/CODEOWNERS, docs/CODEOWNERS) are protected.
Documentation (safe-outputs-pull-requests.md, threat-detection.md): Adds a new "Repository access control files" category to the protected files reference, distinguishing filename-matched files from path-prefix-matched ones.
Compiled lock files: All .lock.yml workflows recompiled; CODEOWNERS now appears in every protected_files array.

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

https://api.github.com/graphql
- Triggering command: /usr/bin/gh /usr/bin/gh api graphql -f query=query($owner: String!, $name: String!) { repository(owner: $owner, name: $name) { hasDiscussionsEnabled } } -f owner=github -f name=gh-aw GO111MODULE 64/bin/go git rev-�� --show-toplevel go /usr/bin/git -json GO111MODULE ache/go/1.25.0/x--show-toplevel git (http block)
- Triggering command: /usr/bin/gh /usr/bin/gh api graphql -f query=query($owner: String!, $name: String!) { repository(owner: $owner, name: $name) { hasDiscussionsEnabled } } -f owner=github -f name=gh-aw go /usr/bin/git git rev-�� --show-toplevel git /usr/bin/git --show-toplevel go ache/uv/0.11.1/x--show-toplevel git (http block)
- Triggering command: /usr/bin/gh /usr/bin/gh api graphql -f query=query($owner: String!, $name: String!) { repository(owner: $owner, name: $name) { hasDiscussionsEnabled } } -f owner=github -f name=gh-aw git /usr/bin/git git rev-�� ath ../../../.pr**/*.json git /usr/bin/git --show-toplevel git /usr/bin/git git (http block)
https://api.github.com/orgs/test-owner/actions/secrets
- Triggering command: /usr/bin/gh gh api /orgs/test-owner/actions/secrets --jq .secrets[].name GOSUMDB GOWORK 64/bin/go GOINSECURE GOMOD erignore ache/go/1.25.0/xGO111MODULE env 3123609/b421/_pkGOINSECURE GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
https://api.github.com/repos/actions/ai-inference/git/ref/tags/v1
- Triggering command: /usr/bin/gh gh api /repos/actions/ai-inference/git/ref/tags/v1 --jq .object.sha user.name Test User /usr/bin/git /tmp/go-build429git -trimpath 64/bin/go git rev-�� --show-toplevel go /usr/bin/git -json GO111MODULE 64/bin/go /usr/bin/git (http block)
- Triggering command: /usr/bin/gh gh api /repos/actions/ai-inference/git/ref/tags/v1 --jq .object.sha --show-toplevel git /usr/bin/git --show-toplevel 64/pkg/tool/linurev-parse /usr/bin/git git rev-�� --show-toplevel git /usr/bin/git --show-toplevel go /usr/bin/git git (http block)
https://api.github.com/repos/actions/checkout/git/ref/tags/v3
- Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v3 --jq .object.sha -json 4414262/b402/_testmain.go 0/x64/bin/node GOINSECURE GOMOD GOMODCACHE 0/x64/bin/node (http block)
- Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v3 --jq .object.sha HEAD git /usr/bin/git --get remote.origin.urrev-parse /usr/bin/infocmp--show-toplevel git rev-�� --show-toplevel infocmp /usr/bin/git xterm-color go /usr/bin/git git (http block)
https://api.github.com/repos/actions/checkout/git/ref/tags/v5
- Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v5 --jq .object.sha -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go env -json GO111MODULE ache/go/1.25.0/x64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
- Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v5 --jq .object.sha github.event.issue.number go /usr/bin/git y-frontmatter.mdgit GO111MODULE x_amd64/compile git rev-�� --show-toplevel x_amd64/compile /usr/bin/git ty-test.md GO111MODULE 64/bin/go git (http block)
- Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v5 --jq .object.sha --show-toplevel go /usr/bin/git -json GO111MODULE ache/go/1.25.0/x--show-toplevel git rev-�� --show-toplevel go 0/x64/bin/node -json GO111MODULE ache/go/1.25.0/x--show-toplevel git (http block)
https://api.github.com/repos/actions/checkout/git/ref/tags/v6
- Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v6 --jq .object.sha -test.paniconexit0 -test.v=true /usr/bin/git -test.timeout=10git -test.run=^Test -test.short=true--show-toplevel git -C nt/action/git/ref/tags/v999.999.999 rev-parse /usr/bin/git @{u} sh 64/bin/go git (http block)
- Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v6 --jq .object.sha /tmp/go-build2794414262/b447/timeutil.test -importcfg /usr/bin/git -s -w -buildmode=exe git -C /tmp/gh-aw-test-runs/20260325-024849-28942/test-3331338261 status /usr/bin/git .github/workflowgit --ignore-path 64/bin/go git (http block)
- Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v6 --jq .object.sha --show-toplevel go /usr/bin/git (http block)
https://api.github.com/repos/actions/github-script/git/ref/tags/v8
- Triggering command: /usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v8 --jq .object.sha GOSUMDB GOWORK 64/bin/go GOINSECURE erignore GOMODCACHE ache/go/1.25.0/xGO111MODULE env 3123609/b427/_pkGOINSECURE GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
- Triggering command: /usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v8 --jq .object.sha 3123609/b411/_pkGOINSECURE GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE lPIPkS6j74YO env 2mBK/_c-hEFTglpgGOINSECURE GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE 3123609/b411/impGOPROXY (http block)
- Triggering command: /usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v8 --jq .object.sha 3123609/b423/_pkGOINSECURE GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go env UftO/VhQUYxu8gwHGOINSECURE GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE 3123609/b423/impGOPROXY (http block)
https://api.github.com/repos/actions/setup-go/git/ref/tags/v4
- Triggering command: /usr/bin/gh gh api /repos/actions/setup-go/git/ref/tags/v4 --jq .object.sha /tmp/TestHashConsistency_GoAndJavaScript4205612770/001/test-fronnonexistent/repo sh /usr/bin/git (http block)
- Triggering command: /usr/bin/gh gh api /repos/actions/setup-go/git/ref/tags/v4 --jq .object.sha --show-toplevel git /usr/bin/git --show-toplevel go /usr/bin/git git rev-�� --show-toplevel git /usr/bin/git --show-toplevel 64/pkg/tool/linurev-parse /usr/bin/git git (http block)
https://api.github.com/repos/actions/setup-node/git/ref/tags/v4
- Triggering command: /usr/bin/gh gh api /repos/actions/setup-node/git/ref/tags/v4 --jq .object.sha /tmp/go-build2794414262/b443/_pkg_.a -trimpath /usr/bin/git -p main -lang=go1.25 git rev-�� --show-toplevel -dwarf=false /usr/bin/git go1.25.0 -c=4 -nolocalimports git (http block)
- Triggering command: /usr/bin/gh gh api /repos/actions/setup-node/git/ref/tags/v4 --jq .object.sha --show-toplevel git /usr/bin/git --show-toplevel go /usr/bin/git git rev-�� --show-toplevel git /usr/bin/git --show-toplevel 64/pkg/tool/linurev-parse /usr/bin/git git (http block)
https://api.github.com/repos/actions/upload-artifact/git/ref/tags/v4
- Triggering command: /usr/bin/gh gh api /repos/actions/upload-artifact/git/ref/tags/v4 --jq .object.sha -json GO111MODULE /opt/hostedtoolcache/go/1.25.0/x64/bin/go GOINSECURE GOMOD GOMODCACHE go env runs/20260325-024849-28942/test-411206722/.github/workflows GO111MODULE 4414262/b431/vet.cfg l GOMOD GOMODCACHE bash (http block)
- Triggering command: /usr/bin/gh gh api /repos/actions/upload-artifact/git/ref/tags/v4 --jq .object.sha --show-toplevel git /usr/bin/git --oneline -1 /opt/hostedtoolc--show-toplevel git rev-�� --show-toplevel node /usr/bin/ls /home/REDACTED/worgit go /usr/bin/git ls (http block)
https://api.github.com/repos/astral-sh/setup-uv/git/ref/tags/eac588ad8def6316056a12d4907a9d4d84ff7a3b
- Triggering command: /usr/bin/gh gh api /repos/astral-sh/setup-uv/git/ref/tags/eac588ad8def6316056a12d4907a9d4d84ff7a3b --jq .object.sha ath ../../../.pr**/*.json git /usr/bin/git --show-toplevel git /usr/bin/gh git er --show-toplevel gh /usr/lib/git-core/git /repos/actions/ginfocmp --jq /usr/bin/git /usr/lib/git-core/git (http block)
https://api.github.com/repos/github/gh-aw
- Triggering command: /usr/bin/gh gh api /repos/github/gh-aw --jq .visibility nt >/dev/null 2>&1 git ules/.bin/sh --show-toplevel git /usr/bin/git git rev-�� th .prettierigno-f git 0/x64/bin/node --show-toplevel git /usr/bin/git git (http block)
https://api.github.com/repos/github/gh-aw-actions/git/ref/tags/v0
- Triggering command: /usr/bin/gh gh api /repos/github/gh-aw-actions/git/ref/tags/v0 --jq .object.sha --show-toplevel git /usr/bin/git --show-toplevel git /usr/bin/git git rev-�� ll 2>&1 git /usr/lib/git-core/git --show-toplevel git /usr/bin/git /usr/lib/git-corconfig (http block)
https://api.github.com/repos/github/gh-aw-actions/git/ref/tags/v1.0.0
- Triggering command: /usr/bin/gh gh api /repos/github/gh-aw-actions/git/ref/tags/v1.0.0 --jq .object.sha -json GO111MODULE /opt/hostedtoolcache/go/1.25.0/x64/bin/go GOINSECURE GOMOD GOMODCACHE go env k/gh-aw/gh-aw GO111MODULE ache/go/1.25.0/x64/pkg/tool/linux_amd64/vet GOINSECURE GOMOD GOMODCACHE ache/go/1.25.0/x64/pkg/tool/linux_amd64/vet (http block)
- Triggering command: /usr/bin/gh gh api /repos/github/gh-aw-actions/git/ref/tags/v1.0.0 --jq .object.sha --show-toplevel git /usr/bin/git nt/action/git/regit rev-parse /usr/bin/git git rev-�� --show-toplevel git /usr/bin/git --show-toplevel go /usr/bin/git git (http block)
https://api.github.com/repos/github/gh-aw-actions/git/ref/tags/v1.2.3
- Triggering command: /usr/bin/gh gh api /repos/github/gh-aw-actions/git/ref/tags/v1.2.3 --jq .object.sha runs/20260325-024849-28942/test-2330468406/.github/workflows GO111MODULE /opt/hostedtoolcache/go/1.25.0/x64/bin/go GOINSECURE GOMOD GOMODCACHE go env k/gh-aw/gh-aw/.github/workflows GO111MODULE ache/go/1.25.0/x64/pkg/tool/linux_amd64/vet GOINSECURE GOMOD GOMODCACHE ache/go/1.25.0/x64/pkg/tool/linux_amd64/vet (http block)
- Triggering command: /usr/bin/gh gh api /repos/github/gh-aw-actions/git/ref/tags/v1.2.3 --jq .object.sha --show-toplevel git /usr/bin/git -aw/git/ref/tagsgit -tests /usr/bin/git git rev-�� --show-toplevel git /usr/bin/bash --show-toplevel go /opt/hostedtoolc--show-toplevel bash (http block)
https://api.github.com/repos/github/gh-aw/actions/runs/1/artifacts
- Triggering command: /usr/bin/gh gh run download 1 --dir test-logs/run-1 GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
https://api.github.com/repos/github/gh-aw/actions/runs/12345/artifacts
- Triggering command: /usr/bin/gh gh run download 12345 --dir test-logs/run-12345 GO111MODULE x_amd64/vet GOINSECURE GOMOD GOMODCACHE x_amd64/vet env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
https://api.github.com/repos/github/gh-aw/actions/runs/12346/artifacts
- Triggering command: /usr/bin/gh gh run download 12346 --dir test-logs/run-12346 GO111MODULE x_amd64/vet GOINSECURE GOMOD GOMODCACHE x_amd64/vet env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
https://api.github.com/repos/github/gh-aw/actions/runs/2/artifacts
- Triggering command: /usr/bin/gh gh run download 2 --dir test-logs/run-2 GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go estl�� -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
https://api.github.com/repos/github/gh-aw/actions/runs/3/artifacts
- Triggering command: /usr/bin/gh gh run download 3 --dir test-logs/run-3 GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
https://api.github.com/repos/github/gh-aw/actions/runs/4/artifacts
- Triggering command: /usr/bin/gh gh run download 4 --dir test-logs/run-4 GO111MODULE x_amd64/compile GOINSECURE GOMOD GOMODCACHE x_amd64/compile env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
https://api.github.com/repos/github/gh-aw/actions/runs/5/artifacts
- Triggering command: /usr/bin/gh gh run download 5 --dir test-logs/run-5 GO111MODULE x_amd64/link GOINSECURE GOMOD GOMODCACHE x_amd64/link env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE ef/N6GE9dzJuLpfUe9tz4e_/ThKvzodBtest@example.com (http block)
https://api.github.com/repos/github/gh-aw/actions/workflows
- Triggering command: /usr/bin/gh gh workflow list --json name,state,path GOSUMDB GOWORK 64/bin/go GOINSECURE GOMOD erignore go env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
- Triggering command: /usr/bin/gh gh run list --json databaseId,number,url,status,conclusion,workflowName,createdAt,startedAt,updatedAt,event,headBranch,headSha,displayTitle --workflow nonexistent-workflow-12345 --limit 100 GOMOD GOMODCACHE sh -c npx prettier --c-errorsas GOPROXY 64/bin/go GOSUMDB GOWORK 64/bin/go sh (http block)
- Triggering command: /usr/bin/gh gh run list --json databaseId,number,url,status,conclusion,workflowName,createdAt,startedAt,updatedAt,event,headBranch,headSha,displayTitle --workflow nonexistent-workflow-12345 --limit 6 GOMOD GOMODCACHE go env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
https://api.github.com/repos/github/gh-aw/git/ref/tags/v1.0.0
- Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v1.0.0 --jq .object.sha -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go env ithout_min-integrity4214070369/001 GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
- Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v1.0.0 --jq .object.sha --show-toplevel ache/go/1.25.0/x64/pkg/tool/linux_amd64/vet /usr/bin/git OKEN }} GO111MODULE /opt/hostedtoolc--show-toplevel git rev-�� --show-toplevel go /usr/bin/git licyMinIntegritygit GO111MODULE ache/go/1.25.0/x--show-toplevel git (http block)
https://api.github.com/repos/github/gh-aw/git/ref/tags/v1.2.3
- Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v1.2.3 --jq .object.sha -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE node /opt�� prettier --check 64/bin/go **/*.ts **/*.json --ignore-path go (http block)
https://api.github.com/repos/github/gh-aw/git/ref/tags/v2.0.0
- Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v2.0.0 --jq .object.sha -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE node /opt�� prettier --check 64/bin/go **/*.ts **/*.json --ignore-path go (http block)
- Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v2.0.0 --jq .object.sha -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE node /opt�� prettier --check 64/bin/go **/*.ts **/*.json --ignore-path git (http block)
- Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v2.0.0 --jq .object.sha -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE sh -c "prettier" --che-errorsas GOPROXY 64/bin/go GOSUMDB GOWORK 64/bin/go git (http block)
https://api.github.com/repos/github/gh-aw/git/ref/tags/v3.0.0
- Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v3.0.0 --jq .object.sha -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE node /opt�� prettier --check 64/bin/go **/*.ts **/*.json --ignore-path git (http block)
https://api.github.com/repos/githubnext/agentics/git/ref/tags/
- Triggering command: /usr/bin/gh gh api /repos/githubnext/agentics/git/ref/tags/# --jq .object.sha re --log-level=e!../../../pkg/workflow/js/**/*.json git /usr/bin/git --show-toplevel git /usr/bin/git git rev-�� js/**/*.json' --ignore-path ../../../.prettierignore git /usr/bin/sh --show-toplevel git /usr/bin/git sh (http block)
https://api.github.com/repos/nonexistent/action/git/ref/tags/v999.999.999
- Triggering command: /usr/bin/gh gh api /repos/nonexistent/action/git/ref/tags/v999.999.999 --jq .object.sha -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
- Triggering command: /usr/bin/gh gh api /repos/nonexistent/action/git/ref/tags/v999.999.999 --jq .object.sha --show-toplevel ache/go/1.25.0/x64/pkg/tool/linux_amd64/vet /usr/bin/git SameOutput238986git GO111MODULE Name,createdAt,s--show-toplevel git rev-�� --show-toplevel ortcfg /usr/bin/git g/styles/huh_thegit g/styles/theme.grev-parse ache/node/24.14.--show-toplevel git (http block)
https://api.github.com/repos/nonexistent/repo/actions/runs/12345
- Triggering command: /usr/bin/gh gh run view 12345 --repo nonexistent/repo --json status,conclusion GOINSECURE GOMOD GOMODCACHE go env 1977511060/.github/workflows GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
https://api.github.com/repos/owner/repo/actions/workflows
- Triggering command: /usr/bin/gh gh workflow list --json name,state,path --repo owner/repo 64/bin/go GOINSECURE GOMOD GOMODCACHE go env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
- Triggering command: /usr/bin/gh gh workflow list --json name,state,path --repo owner/repo 64/bin/go GOINSECURE GOMOD GOMODCACHE go env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE /bin/sh (http block)
https://api.github.com/repos/owner/repo/contents/file.md
- Triggering command: /tmp/go-build2794414262/b402/cli.test /tmp/go-build2794414262/b402/cli.test -test.testlogfile=/tmp/go-build2794414262/b402/testlog.txt -test.paniconexit0 -test.v=true -test.parallel=4 -test.timeout=10m0s -test.run=^Test -test.short=true GOINSECURE GOMOD ode-gyp-bin/node-json ache/go/1.25.0/xGO111MODULE env 3123609/b392/_pkGOINSECURE GO111MODULE 64/bin/go GOINSECURE b/gh-aw/cmd/gh-aenv GOMODCACHE go (http block)
https://api.github.com/repos/test-owner/test-repo/actions/secrets
- Triggering command: /usr/bin/gh gh api /repos/test-owner/test-repo/actions/secrets --jq .secrets[].name GOSUMDB GOWORK 64/bin/go GOINSECURE GOMOD erignore ache/go/1.25.0/xGO111MODULE env 3123609/b438/_pkGOINSECURE GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)

If you need me to access, download, or install something from one of these locations, you can either:

Configure Actions setup steps to set up my environment, which run before the firewall is enabled
Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

📱 Kick off Copilot coding agent tasks wherever you are with GitHub Mobile, available on iOS and Android.

pelikhan · 2026-03-25T02:47:12Z

@copilot protect common locations

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com> Agent-Logs-Url: https://github.com/github/gh-aw/sessions/2b702ae0-dd15-4f43-ad9e-afc1e02df113

Copilot

Pull request overview

Adds CODEOWNERS to the “protected files” set so it’s protected by basename anywhere in the repo (root, docs/, .github/), and updates docs + compiled workflow lockfiles accordingly.

Changes:

Extend protected-file detection to always include CODEOWNERS by filename (pkg/workflow/runtime_definitions.go).
Update reference documentation to describe the new (4th) protected-files source/category.
Recompile workflow lockfiles so generated protected_files arrays include CODEOWNERS.

Reviewed changes

Copilot reviewed 47 out of 47 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
pkg/workflow/runtime_definitions.go	Adds `CODEOWNERS` to basename-matched protected files via a new list appended in `getAllManifestFiles()`.
docs/src/content/docs/reference/threat-detection.md	Documents the new 4th protected-files source/category for access-control files (`CODEOWNERS`).
docs/src/content/docs/reference/safe-outputs-pull-requests.md	Updates protected-files docs to include access-control files; needs a header fix (“three” → “four”).
.github/workflows/weekly-safe-outputs-spec-review.lock.yml	Regenerated safe-outputs config to include `CODEOWNERS` in `protected_files`.
.github/workflows/weekly-editors-health-check.lock.yml	Regenerated safe-outputs config to include `CODEOWNERS` in `protected_files`.
.github/workflows/weekly-blog-post-writer.lock.yml	Regenerated safe-outputs config to include `CODEOWNERS` in `protected_files`.
.github/workflows/update-astro.lock.yml	Regenerated safe-outputs config to include `CODEOWNERS` in `protected_files`.
.github/workflows/unbloat-docs.lock.yml	Regenerated safe-outputs config to include `CODEOWNERS` in `protected_files`.
.github/workflows/ubuntu-image-analyzer.lock.yml	Regenerated safe-outputs config to include `CODEOWNERS` in `protected_files`.
.github/workflows/tidy.lock.yml	Regenerated safe-outputs config to include `CODEOWNERS` in `protected_files`.
.github/workflows/test-create-pr-error-handling.lock.yml	Regenerated safe-outputs config to include `CODEOWNERS` in `protected_files`.
.github/workflows/technical-doc-writer.lock.yml	Regenerated safe-outputs config to include `CODEOWNERS` in `protected_files`.
.github/workflows/smoke-update-cross-repo-pr.lock.yml	Regenerated safe-outputs config to include `CODEOWNERS` in `protected_files`.
.github/workflows/smoke-project.lock.yml	Regenerated safe-outputs config to include `CODEOWNERS` in `protected_files`.
.github/workflows/smoke-multi-pr.lock.yml	Regenerated safe-outputs config to include `CODEOWNERS` in `protected_files`.
.github/workflows/smoke-create-cross-repo-pr.lock.yml	Regenerated safe-outputs config to include `CODEOWNERS` in `protected_files`.
.github/workflows/smoke-claude.lock.yml	Regenerated safe-outputs config to include `CODEOWNERS` in `protected_files`.
.github/workflows/slide-deck-maintainer.lock.yml	Regenerated safe-outputs config to include `CODEOWNERS` in `protected_files`.
.github/workflows/schema-feature-coverage.lock.yml	Regenerated safe-outputs config to include `CODEOWNERS` in `protected_files`.
.github/workflows/refiner.lock.yml	Regenerated safe-outputs config to include `CODEOWNERS` in `protected_files`.
.github/workflows/q.lock.yml	Regenerated safe-outputs config to include `CODEOWNERS` in `protected_files`.
.github/workflows/poem-bot.lock.yml	Regenerated safe-outputs config to include `CODEOWNERS` in `protected_files`.
.github/workflows/mergefest.lock.yml	Regenerated safe-outputs config to include `CODEOWNERS` in `protected_files`.
.github/workflows/layout-spec-maintainer.lock.yml	Regenerated safe-outputs config to include `CODEOWNERS` in `protected_files`.
.github/workflows/jsweep.lock.yml	Regenerated safe-outputs config to include `CODEOWNERS` in `protected_files`.
.github/workflows/instructions-janitor.lock.yml	Regenerated safe-outputs config to include `CODEOWNERS` in `protected_files`.
.github/workflows/hourly-ci-cleaner.lock.yml	Regenerated safe-outputs config to include `CODEOWNERS` in `protected_files`.
.github/workflows/go-logger.lock.yml	Regenerated safe-outputs config to include `CODEOWNERS` in `protected_files`.
.github/workflows/glossary-maintainer.lock.yml	Regenerated safe-outputs config to include `CODEOWNERS` in `protected_files`.
.github/workflows/github-mcp-tools-report.lock.yml	Regenerated safe-outputs config to include `CODEOWNERS` in `protected_files`.
.github/workflows/functional-pragmatist.lock.yml	Regenerated safe-outputs config to include `CODEOWNERS` in `protected_files`.
.github/workflows/dictation-prompt.lock.yml	Regenerated safe-outputs config to include `CODEOWNERS` in `protected_files`.
.github/workflows/developer-docs-consolidator.lock.yml	Regenerated safe-outputs config to include `CODEOWNERS` in `protected_files`.
.github/workflows/dead-code-remover.lock.yml	Regenerated safe-outputs config to include `CODEOWNERS` in `protected_files`.
.github/workflows/daily-workflow-updater.lock.yml	Regenerated safe-outputs config to include `CODEOWNERS` in `protected_files`.
.github/workflows/daily-safe-output-integrator.lock.yml	Regenerated safe-outputs config to include `CODEOWNERS` in `protected_files`.
.github/workflows/daily-rendering-scripts-verifier.lock.yml	Regenerated safe-outputs config to include `CODEOWNERS` in `protected_files`.
.github/workflows/daily-doc-updater.lock.yml	Regenerated safe-outputs config to include `CODEOWNERS` in `protected_files`.
.github/workflows/daily-doc-healer.lock.yml	Regenerated safe-outputs config to include `CODEOWNERS` in `protected_files`.
.github/workflows/daily-community-attribution.lock.yml	Regenerated safe-outputs config to include `CODEOWNERS` in `protected_files`.
.github/workflows/daily-architecture-diagram.lock.yml	Regenerated safe-outputs config to include `CODEOWNERS` in `protected_files`.
.github/workflows/craft.lock.yml	Regenerated safe-outputs config to include `CODEOWNERS` in `protected_files`.
.github/workflows/code-simplifier.lock.yml	Regenerated safe-outputs config to include `CODEOWNERS` in `protected_files`.
.github/workflows/code-scanning-fixer.lock.yml	Regenerated safe-outputs config to include `CODEOWNERS` in `protected_files`.
.github/workflows/cloclo.lock.yml	Regenerated safe-outputs config to include `CODEOWNERS` in `protected_files`.
.github/workflows/ci-coach.lock.yml	Regenerated safe-outputs config to include `CODEOWNERS` in `protected_files`.
.github/workflows/changeset.lock.yml	Regenerated safe-outputs config to include `CODEOWNERS` in `protected_files`.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2026-03-25T02:59:02Z

docs/src/content/docs/reference/safe-outputs-pull-requests.md

@@ -216,8 +216,14 @@ Protection covers three categories:



The section now includes a 4th category, but the header line still says "Protection covers three categories". Update the header to reflect four categories (or reword) so the documentation matches the list below.

Copilot · 2026-03-25T02:59:03Z

pkg/workflow/runtime_definitions.go

+// securityConfigFiles are repository security configuration files that are
+// always protected by filename regardless of their location in the repository.
+// These complement the path-prefix protection (e.g. ".github/") and ensure
+// that files placed at the repo root or in "docs/" are equally protected.
+var securityConfigFiles = []string{
+	"CODEOWNERS", // Governs required reviewers; valid at repo root, .github/, or docs/
+}


The new slice is named/commented as "security configuration" files, but it currently contains CODEOWNERS, which the docs describe as an access-control file. Consider renaming (and updating the comment) to match the terminology used in the docs (e.g., "accessControlFiles" / "repoAccessControlFiles") to reduce confusion about why these are included in protected_files.

Initial plan

91fb510

Copilot AI assigned Copilot and pelikhan Mar 25, 2026

Copilot started work on behalf of pelikhan March 25, 2026 02:40 View session

Add CODEOWNERS to protected files set

f0337e6

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com> Agent-Logs-Url: https://github.com/github/gh-aw/sessions/2b702ae0-dd15-4f43-ad9e-afc1e02df113

pelikhan marked this pull request as ready for review March 25, 2026 02:55

Copilot AI review requested due to automatic review settings March 25, 2026 02:55

Copilot started reviewing on behalf of pelikhan March 25, 2026 02:56 View session

pelikhan merged commit 9d91a85 into main Mar 25, 2026
2 checks passed

pelikhan deleted the copilot/add-codeowners-to-protected-files branch March 25, 2026 02:56

Copilot AI changed the title ~~[WIP] Add CODEOWNERS file to protected files set~~ Add CODEOWNERS to protected files set Mar 25, 2026

Copilot AI requested a review from pelikhan March 25, 2026 02:57

Copilot stopped work on behalf of pelikhan due to an error March 25, 2026 02:57
The session was cancelled by the user.

Copilot AI reviewed Mar 25, 2026

View reviewed changes

github-actions bot mentioned this pull request Mar 25, 2026

Move threat detection into a separate detection job #22782

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add CODEOWNERS to protected files set#22821

Add CODEOWNERS to protected files set#22821
pelikhan merged 2 commits intomainfrom
copilot/add-codeowners-to-protected-files

Copilot AI commented Mar 25, 2026 •

edited

Loading

Uh oh!

pelikhan commented Mar 25, 2026

Uh oh!

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI Mar 25, 2026

Uh oh!

Copilot AI Mar 25, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

Copilot AI commented Mar 25, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Changes

I tried to connect to the following addresses, but was blocked by firewall rules:

Uh oh!

pelikhan commented Mar 25, 2026

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Copilot AI Mar 25, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 25, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Copilot AI commented Mar 25, 2026 •

edited

Loading