chore: require admin approval for .github

[avivkeller]

Fixes #7986

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Preview	Updated (UTC)
nodejs-org	Ready	Preview	Nov 24, 2025 1:12pm

[Copilot]

Pull request overview

This PR adds the @nodejs/web-admins team as a required reviewer for changes to the .github directory, ensuring that administrative approval is obtained for GitHub configuration changes alongside the existing @nodejs/web-infra team review.

• Adds @nodejs/web-admins team as an additional code owner for the .github directory

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 76.29%. Comparing base (8504a85) to head (b0850c0).
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #8363   +/-   ##
=======================================
  Coverage   76.29%   76.29%           
=======================================
  Files         118      118           
  Lines        9903     9903           
  Branches      336      336           
=======================================
  Hits         7555     7555           
  Misses       2346     2346           
  Partials        2        2           

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

[MattIPv4]

Is this needed still, I thought the SHA pins were removed from the repo allow-list, so web-infra can merge bumps? Admins would only be needed for net-new actions now?

[bmuenzenmeyer]

Is this needed still, I thought the SHA pins were removed from the repo allow-list, so web-infra can merge bumps? Admins would only be needed for net-new actions now?

I was just wondering this - I think this covers the new action case

[MattIPv4]

Yeh, if this is just for new actions now I think I'd probably prefer to allow web-infra to merge without admin approval. This ask originally came out of us merging Dependabot updates and breaking CI, but I think there's a lot less risk if it's just new actions that'll break without admin involvement.