security: extend CODEOWNERS to Makefile and scripts/ (H2 mitigation)#1028
Open
security: extend CODEOWNERS to Makefile and scripts/ (H2 mitigation)#1028
Conversation
21 tasks
There was a problem hiding this comment.
Pull request overview
Extends repository path-based CODEOWNERS protections to reduce the auto-merge blast radius for build/release-related changes (per audit finding H2 mitigation).
Changes:
- Adds CODEOWNERS entries for
/Makefileto require@microsasareview. - Adds CODEOWNERS entries for
/scripts/to require@microsasareview.
microsasa
force-pushed
the
fix/h2-codeowners-extend
branch
from
ce9dd46 to
9d334bf
Compare
Cap auto-merge blast radius for build glue and release scripts. ## Rationale H2 from audit #92 proposed a human-only label gate on quality-gate to prevent prompt-injection-driven auto-APPROVE. That fix kills pipeline autonomy (the whole point is no-human-in-the-loop). Instead, we cap blast radius by path: let quality-gate auto-approve PRs freely for application code (src/, tests/, docs/), but require human review for paths where a malicious change could execute arbitrary code during CI or release: - /Makefile — executed by ci.yml via `make ci`; malicious target would run in CI with whatever privileges ci.yml has. - /scripts/ — currently hold-for-merge.sh and release-from-merge.sh; release-gating logic. Compromise → bad artifacts shipped. ## Defense layers (from audit findings) 1. Option A: only @microsasa has triage role, so only @microsasa can apply 'aw' label → pipeline ignores external input. 2. Option B: gh-aw v0.68.7 XPIA/homoglyph/heredoc sanitization active as of PR #1023. 3. Option C (this PR): CODEOWNERS blocks auto-merge of changes to sensitive build/release paths. Pipeline autonomy preserved for src/, tests/, docs/. Refs #92 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
microsasa
force-pushed
the
fix/h2-codeowners-extend
branch
from
9d334bf to
ab4e921
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Caps auto-merge blast radius for build/release paths without killing pipeline autonomy.
Context
Audit #92 finding H2 originally proposed adding a human-only
ready-for-auto-approvelabel gate onquality-gateto prevent prompt-injection-driven auto-APPROVE. That fix breaks the pipeline's core value proposition (no-human-in-the-loop).This PR implements the reframed fix: cap blast radius by path, not by approval.
Change
Extend
.github/CODEOWNERSto cover:/Makefile— executed byci.ymlviamake ci; a malicious target runs arbitrary code in CI./scripts/— currently containshold-for-merge.shandrelease-from-merge.sh; release-gating logic. Compromise means shipping bad artifacts.Defense in depth (all 3 active after this merges)
@microsasahas triage role, so only@microsasacan apply theawlabel. Pipeline ignores external issues/PRs. (Verified: all 20 most recentawissues authored by @microsasa.)Pipeline impact
Zero. Quality-gate continues to auto-approve PRs touching
src/,tests/,docs/, etc. Only PRs that shouldn't auto-merge anyway (touching workflows, lock files, build glue, release scripts) now require your explicit review.Refs
Refs #92 (meta — do NOT close)