Add CODEOWNERS for plumbing + unblock Scorecard Dependency-Update-Tool#45
Merged
Conversation
CODEOWNERS: lists @wnstify as required reviewer for high-risk paths (.github/workflows, .github/scripts, /scripts, SECURITY.md, .gitattributes, renovate.json, .pre-commit-config.yaml, .yamllint.yml, CODEOWNERS itself). Combined with the existing branch-protection setting require_code_owner_reviews: true, any PR touching plumbing now needs @wnstify approval. Routine Renovate compose bumps don't match any pattern, so their auto-merge flow is preserved. .gitattributes: remove `renovate.json export-ignore`. OpenSSF Scorecard scans the repo via GitHub's tarball endpoint, which honors export-ignore. Hiding renovate.json caused the Dependency-Update-Tool check to score 0 ("no update tool detected") despite the file being correctly configured at repo root. Restoring it to the tarball is a ~4 KB cost and brings the check back to 10.
wnstfy
enabled auto-merge (squash)
May 22, 2026 12:36
Contributor
Trivy misconfiguration findings (HIGH + CRITICAL)✅ No HIGH or CRITICAL misconfigurations detected. |
4 tasks
wnstfy
added a commit
that referenced
this pull request
May 22, 2026
…hecks (#48) Same root cause as the renovate.json export-ignore restored in PR #45: OpenSSF Scorecard scans the repo via GitHub's /tarball/ endpoint, which honors .gitattributes export-ignore. Excluding .github/ caused four checks (Dangerous-Workflow, Pinned-Dependencies, Token-Permissions, Packaging) to report "no workflows found" and skip with score -1 — rendered as "?" in the scorecard.dev viewer. Restoring .github/ to the tarball adds ~30-40 KB but unblocks Scorecard's validation of the workflow hardening that's already in place: SHA-pinned actions, least-privilege permissions blocks, no pull_request_target with checkout, env-hoisted user input. Projected score impact: 7.4 → ~8.7-9.0 after next scan, depending on how Packaging's heuristic evaluates our `gh release create`-based release workflow. Tracked upstream as ossf/scorecard#5069.
3 tasks
wnstfy
added a commit
that referenced
this pull request
May 25, 2026
CODEOWNERS was introduced in PR #45 with `@wnstify` listed as the owner for every plumbing path. `wnstify` is the organization handle, not a user. GitHub's CODEOWNERS validator rejects this with "Unknown owner" errors (verifiable via `gh api repos/wnstify/docker/codeowners/errors`), which silently disables the `require_code_owner_reviews: true` gate for every covered path. Result: every plumbing PR since 2026-05-22 has merged through the count=1 review gate without any actual code-owner enforcement. No maintainer review was ever required for `.github/workflows/`, `.github/scripts/`, `CODEOWNERS` itself, etc. Fix: rewrite every entry to use the real user handle `@wnstfy`. After this lands, the CODEOWNERS gate becomes effective, and plumbing PRs authored by @wnstfy will block on the code-owner self-review condition — requiring the documented enforce_admins toggle dance to merge. Validate after merge with: gh api repos/wnstify/docker/codeowners/errors which should return `{"errors":[]}`.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
@wnstifyas required reviewer for plumbing paths (workflows, scripts, security policy, .gitattributes, renovate.json, contributor configs, CODEOWNERS itself). Routine Renovate compose-only bumps don't match any pattern → their auto-merge flow is preserved unchanged.renovate.json export-ignore. Scorecard scans via the tarball endpoint, which honors export-ignore, so hiding renovate.json caused the Dependency-Update-Tool check to score 0. This restores it.Why now
Architectural notes
With
require_code_owner_reviews: truealready active andrequired_approving_review_count: 0:enforce_admins: falsetoggle — accepted operational friction.Test plan
.gitattributeschange doesn't break existing exclusions (only one line removed)scan+misconfig+lint+Analyze (actions)all green