Skip to content

security(codeowners): audit protected surfaces and add missing ownership entries #272

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
dDevAhmed merged 1 commit into from
Oct 18, 2026
Merged

security(codeowners): audit protected surfaces and add missing ownership entries #272

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
28 changes: 23 additions & 5 deletions .github/CODEOWNERS
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,11 +19,29 @@
/docs/contributing/security-guidelines.md @dDevAhmed
/docs/contributing/dependency-policy.md @dDevAhmed
/docs/contributing/changesets.md @dDevAhmed
/docs/architecture/threat-model.md @dDevAhmed
/docs/architecture/trust-boundaries.md @dDevAhmed
/docs/adr/ADR-0003-release-and-versioning-strategy.md @dDevAhmed
/docs/adr/ADR-0004-security-baseline.md @dDevAhmed
/docs/architecture/ @dDevAhmed
/docs/adr/ @dDevAhmed
/docs/roadmap/v1-readiness.md @dDevAhmed

# Current CLI failure/output boundaries that protect error and terminal handling
# CLI entry-point and version surface
/src/cli.ts @dDevAhmed
/src/main.ts @dDevAhmed
/src/version.ts @dDevAhmed
/src/commands/root.ts @dDevAhmed

# Security and trust boundary modules
/src/errors/ @dDevAhmed
/src/output/ @dDevAhmed
/src/config/ @dDevAhmed
/src/process/ @dDevAhmed
/src/deployment/ @dDevAhmed

# Generator security-sensitive surfaces
/src/generator/validation.ts @dDevAhmed
/src/generator/template-generation.ts @dDevAhmed
/src/generator/template-registry.ts @dDevAhmed
/src/generator/template-sources.ts @dDevAhmed

# Dev orchestration and environment handling
/src/dev/orchestrator.ts @dDevAhmed
/src/dev/environment.ts @dDevAhmed
23 changes: 20 additions & 3 deletions docs/contributing/ownership.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,23 +10,40 @@ Mandatory code-owner approval must be configured separately through the reposito

## Current Sensitive Areas

The initial ownership boundary covers:
The ownership boundary covers all frozen protected surfaces defined in `docs/contributing/wave-architecture.md`:

- GitHub Actions workflows and dependency automation;
- CODEOWNERS itself;
- Changesets and package/lockfile release metadata;
- public security policy and dependency/security engineering guidance;
- the full ADR directory and architecture documents;
- the v1 readiness roadmap;
- CLI entry-point, version, and root command modules;
- threat-model and trust-boundary documents;
- release/security ADRs;
- the current CLI error boundary and terminal-output layer.
- the CLI error boundary and terminal-output layer;
- project configuration module (`src/config/`);
- process execution module (`src/process/`);
- deployment module (`src/deployment/`);
- generator security-sensitive surfaces: validation, template generation, template registry, and template sources;
- dev orchestration and environment handling.

These areas can affect execution trust, supply-chain integrity, secret handling, user-visible failure behavior, or future release authority and therefore receive explicit maintainer review.

## What Is Intentionally Not Globally Owned

CODEOWNERS does not assign a blanket owner to the whole repository. Ordinary feature modules, tests, general documentation, and contributor-facing work should remain approachable without unnecessary mandatory-owner routing unless their risk profile changes.

As new sensitive modules are introduced—such as deployment, credential handling, remote templates/plugins, filesystem mutation, or package publishing—the CODEOWNERS boundary should be updated in the same pull request or a tightly related security follow-up.
Specifically, the following remain open contributor zones:

- `tests/` — unit and integration test files;
- `templates/` — starter template contents (excluding introduction/removal/renaming at the top level);
- `docs/` general guides, reference docs, and contributing guides (except the protected surfaces listed above);
- `src/diagnostics/` — diagnostic implementations;
- `src/testing/` — test-support utilities;
- `src/commands/` — individual command implementations (except `root.ts`).

As new sensitive modules are introduced—such as credential handling, remote templates/plugins, or package publishing—the CODEOWNERS boundary should be updated in the same pull request or a tightly related security follow-up.

## Enforcement

Expand Down