ci: CODEOWNERS on workflows so the human-authors gate cannot be silently removed - #2816
ci: CODEOWNERS on workflows so the human-authors gate cannot be silently removed#2816Hugo0 wants to merge 1 commit into
Conversation
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
|
Important Review skippedAuto reviews are disabled on base/target branches other than the default branch. Please check the settings in the CodeRabbit UI or the ⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
Comment |
Code-analysis diffPainscore total: 7425.76 → 7425.76 (0) |
🧪 UI test report — ✅ all greenSuites
📊 Coverage (unit)
⏱ 10 slowest test cases
|
![chip-peanut-bot[bot]](https://avatars.githubusercontent.com/in/2915219?s=60&v=4){kind=small}
There was a problem hiding this comment.
Chip review — changes requested
Request changes: the workflow ownership rule is valid but does not own CODEOWNERS itself, leaving a two-PR bypass of the intended review gate.
Findings
-
MAJOR · .github/CODEOWNERS:3 · Own the CODEOWNERS policy file
On dev, PR A can delete only .github/CODEOWNERS; line 3 owns only workflows, so GitHub assigns no code owner and the zero-approval ruleset can still merge it. PR B can then remove the human-authors workflow with no code-owner gate. GitHub evaluates ownership from the base branch and recommends owning CODEOWNERS itself. Add /.github/CODEOWNERS @Hugo0 (or own /.github/). -
MAJOR · .github/CODEOWNERS:3 · [moonshotai/kimi-k3] CODEOWNERS file itself is unprotected — two-step silent removal still possible
The only rule is/.github/workflows/ @Hugo0, so once 'require code owner review' is enabled on the dev ruleset, a PR touching .github/CODEOWNERS requires no code-owner review. An attacker (or careless contributor) can land PR #1 editing or deleting .github/CODEOWNERS with zero approvals, then PR #2 deleting or neutering the human-authors job in .github/workflows/ merges green — exactly the silent-removal scenario this PR claims to close. Fix: add a rule owning the CODEOWNERS file (and ideally the whole .github/ directory, since workflow-adjacent files like composite actions under .github/actions/ can also alter what the gate executes), e.g./.github/ @Hugo0or at minimum/.github/CODEOWNERS @Hugo0, placed after (or instead of) the workflows rule.
Checked clean
- Exact detached head and merge-base diff: only .github/CODEOWNERS is added.
- CODEOWNERS syntax validation is clean, and @Hugo0 has admin access.
- Exact-head CI completed successfully; no failing gate to repeat.
- GitHub base-branch CODEOWNERS behavior and the active dev ruleset review settings.
Second opinion by moonshotai/kimi-k3: 1 finding(s), marked with the model name. It reads the diff only, so treat its findings as advice.
Exact head: 0ca09c399faf · Context: repo, github, github-docs
| @@ -0,0 +1,3 @@ | |||
| # Workflow files gate the human-authors policy. A PR that edits them needs a | |||
| # code-owner review, so the gate cannot be removed by a PR nobody reads. | |||
| /.github/workflows/ @Hugo0 | |||
There was a problem hiding this comment.
MAJOR: Own the CODEOWNERS policy file
On dev, PR A can delete only .github/CODEOWNERS; line 3 owns only workflows, so GitHub assigns no code owner and the zero-approval ruleset can still merge it. PR B can then remove the human-authors workflow with no code-owner gate. GitHub evaluates ownership from the base branch and recommends owning CODEOWNERS itself. Add /.github/CODEOWNERS @Hugo0 (or own /.github/).
| @@ -0,0 +1,3 @@ | |||
| # Workflow files gate the human-authors policy. A PR that edits them needs a | |||
| # code-owner review, so the gate cannot be removed by a PR nobody reads. | |||
| /.github/workflows/ @Hugo0 | |||
There was a problem hiding this comment.
MAJOR: [moonshotai/kimi-k3] CODEOWNERS file itself is unprotected — two-step silent removal still possible
The only rule is /.github/workflows/ @Hugo0, so once 'require code owner review' is enabled on the dev ruleset, a PR touching .github/CODEOWNERS requires no code-owner review. An attacker (or careless contributor) can land PR #1 editing or deleting .github/CODEOWNERS with zero approvals, then PR #2 deleting or neutering the human-authors job in .github/workflows/ merges green — exactly the silent-removal scenario this PR claims to close. Fix: add a rule owning the CODEOWNERS file (and ideally the whole .github/ directory, since workflow-adjacent files like composite actions under .github/actions/ can also alter what the gate executes), e.g. /.github/ @Hugo0 or at minimum /.github/CODEOWNERS @Hugo0, placed after (or instead of) the workflows rule.
1 participant
Follow-up to #2805 (the CODEOWNERS commit landed on the branch after the merge).
Summary: 3-line CODEOWNERS: any PR editing .github/workflows/ needs a code-owner (Hugo) review. Closes the hole where a PR could delete the human-authors job and still merge green with 0 approvals on dev.
Risk: none at runtime — only binds once code-owner review is required on the dev ruleset (org Staging ruleset flip, pending).
QA: file syntax is the standard CODEOWNERS pattern; enforced by GitHub, no CI change.