Add CODEOWNERS: require RelOps review for security-critical changes#45
Merged
Conversation
relops-bootstrap defines the trust anchors, mTLS/Cloud-Armor network posture, broker auth, per-secret IAM, and the CA's SCEP provisioners — anyone with write could previously get a change to any of those merged with a single approval from a broad collaborator set (incl. releng/taskcluster), no RelOps sign-off required. Gate the security-critical surface to @mozilla-platform-ops/relops (and the CODEOWNERS file itself). Pure docs (README, docs/*.html, sub-READMEs) are left ungated to keep documentation low-friction. Prerequisite: grant the relops team WRITE access to this repo, and enable "Require review from Code Owners" on the main branch protection (it currently requires 1 approval but not code-owner review). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Applies the same change-control pattern as hangar's allowlist safeguard, scoped to relops-bootstrap's security-critical surface — the repo is the system under security review.
Why: today
mainrequires 1 approval but not code-owner review, and write access is a broad set of individual collaborators (incl. releng/taskcluster). So a change that widens the Cloud Armor CIDR, relaxes Cloud Run ingress, adds a SCEP role (= mints certs for a new role), or editsverify_mtls_headerscould merge with a single rubber-stamp and no RelOps sign-off.Gated to
@mozilla-platform-ops/relops:/terraform/,/broker/,/scripts/bootstrap-step-ca.sh,/orchestrator/,/mdm/,/cloudbuild.yaml,/SECURITY.md, and/.github/CODEOWNERS(self-gate). Pure docs (README.md,docs/*.html, sub-READMEs) are intentionally not gated.Effect: RelOps owns the infra, so releng/others need a
relopsapproval for changes under those paths — the intended change-control (confirmed intent).To enforce (repo-admin, being done alongside this):
relopsteam Write on this repo (it currently has none).mainbranch protection.🤖 Generated with Claude Code