From 279f74d1f815a7b9a9638bef89de26559727b3df Mon Sep 17 00:00:00 2001 From: sabo Date: Sun, 18 Oct 2026 18:58:43 +0000 Subject: [PATCH 1/3] chore: add CODEOWNERS for supply-chain sensitive paths Assigns ownership of the paths that can execute code or ship binary assets: .vscode/, .devcontainer/, package.json, .github/workflows/, .github/CODEOWNERS, scripts/guard/, tests/guard/, public/fonts/, dist/. Last-match-wins ordering (most-specific last). No wildcard rule, so Rust source ownership is not affected. Note: this file records intent. It only becomes a mandatory review rule once branch protection enables 'Require review from Code Owners' on main. That protection is NOT currently enabled (protection API returns 404) and is deliberately not part of this PR. --- .github/CODEOWNERS | 32 ++++++++++++++++++++++++++++++++ 1 file changed, 32 insertions(+) create mode 100644 .github/CODEOWNERS diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS new file mode 100644 index 00000000..bfab2478 --- /dev/null +++ b/.github/CODEOWNERS @@ -0,0 +1,32 @@ +# CODEOWNERS — supply-chain sensitive paths +# +# Require maintainer review before changes to paths that can execute code or +# ship binary assets. GitHub evaluates rules top-to-bottom and applies the +# LAST matching pattern; keep the most specific entries last. +# +# NOTE: This file assigns ownership and records intent. It becomes a +# MANDATORY review rule only when branch protection enables +# "Require review from Code Owners" on `main`. As of 2026-10-18 that rule +# is NOT enabled (branch protection returns 404 / empty ruleset), so this +# file alone does not block any merge. + +# Editor / dev-container auto-execution surface +/.vscode/ @naninu123 +/.devcontainer/ @naninu123 + +# npm lifecycle hooks +/package.json @naninu123 + +# CI workflows (can inject arbitrary runner steps) +/.github/workflows/ @naninu123 + +# The CODEOWNERS file itself +/.github/CODEOWNERS @naninu123 + +# Guardrail code + fixtures (can weaken the safety net) +/scripts/guard/ @naninu123 +/tests/guard/ @naninu123 + +# Binary / font assets (the incident disguised JS as a font here) +/public/fonts/ @naninu123 +/dist/ @naninu123 From fcded06c620c5e7bc7a4b2e9ee1fabd8ea193dfd Mon Sep 17 00:00:00 2001 From: naninu123 Date: Mon, 19 Oct 2026 04:11:02 +0000 Subject: [PATCH 2/3] fix(codeowners): cover Cargo manifests, lockfiles, build scripts, actions, dependabot - Add /Cargo.toml, /crates/*/Cargo.toml, /tests/fixtures/testnet-smoke/Cargo.toml - Add /Cargo.lock, /tests/fixtures/testnet-smoke/Cargo.lock - Add /crates/sdkt-cli/build.rs, /crates/sdkt-core/src/build.rs - Add /.github/actions/, /.github/dependabot.yml - Add /Makefile, /install.sh, /website/playground/build.sh - All owners @naninu123 - Validated: 28 sensitive paths covered, 0 uncovered (4 benign paths intentionally excluded) --- .github/CODEOWNERS | 28 ++++++++++++++++++++++++++++ 1 file changed, 28 insertions(+) diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS index bfab2478..e66ba9df 100644 --- a/.github/CODEOWNERS +++ b/.github/CODEOWNERS @@ -30,3 +30,31 @@ # Binary / font assets (the incident disguised JS as a font here) /public/fonts/ @naninu123 /dist/ @naninu123 + +# Cargo manifests (dependency resolution — supply-chain attack surface) +/Cargo.toml @naninu123 +/crates/*/Cargo.toml @naninu123 +/tests/fixtures/testnet-smoke/Cargo.toml @naninu123 + +# Lockfiles (pin exact dependency versions) +/Cargo.lock @naninu123 +/tests/fixtures/testnet-smoke/Cargo.lock @naninu123 + +# Build scripts (execute at compile time) +/crates/sdkt-cli/build.rs @naninu123 +/crates/sdkt-core/src/build.rs @naninu123 + +# GitHub Actions (can inject arbitrary runner steps) +/.github/actions/ @naninu123 + +# Dependabot config (can change dependency update policy) +/.github/dependabot.yml @naninu123 + +# Build orchestration (Makefile can run arbitrary commands) +/Makefile @naninu123 + +# Install script (executes on user machines) +/install.sh @naninu123 + +# Playground build script (produces wasm artifacts) +/website/playground/build.sh @naninu123 From 4493acf0244b44fbaf650ac193749e65894dccf6 Mon Sep 17 00:00:00 2001 From: naninu123 Date: Mon, 19 Oct 2026 04:29:02 +0000 Subject: [PATCH 3/3] fix(codeowners): add crates/sdkt-playground/Cargo.lock Root-caused via git ls-files: tracked lockfile at crates/sdkt-playground/Cargo.lock was not covered by the /Cargo.lock rule (anchored at repo root; nested lockfiles need their own entry). Validated with the @hmarr/codeowners port (same path_to_regex semantics as github.com/gitlab CODEOWNERS): 22 tracked lockfile now resolves to @naninu123; 22-path sensitivity matrix covered, 0 uncovered, all 22 rules owned by @naninu123. --- .github/CODEOWNERS | 1 + 1 file changed, 1 insertion(+) diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS index e66ba9df..480b646a 100644 --- a/.github/CODEOWNERS +++ b/.github/CODEOWNERS @@ -38,6 +38,7 @@ # Lockfiles (pin exact dependency versions) /Cargo.lock @naninu123 +/crates/sdkt-playground/Cargo.lock @naninu123 /tests/fixtures/testnet-smoke/Cargo.lock @naninu123 # Build scripts (execute at compile time)