# Hard security tier: an independent SecOps review is required for every author.
# Enable required code-owner reviews and dismiss stale approvals in branch protection.
# Last matching rule wins. Keep SecOps the sole owner of these paths: listing
# another team on the same line would allow that team to satisfy the requirement.

# Security policy and ownership determine who can approve protected changes.
/.github/CODEOWNERS @openclaw/openclaw-secops
/SECURITY.md @openclaw/openclaw-secops

# CodeQL policy, queries, and execution; vulnerability update and workflow-audit policy.
/.github/codeql/ @openclaw/openclaw-secops
/.github/workflows/codeql*.yml @openclaw/openclaw-secops
/.github/dependabot.yml @openclaw/openclaw-secops
/.github/zizmor.yml @openclaw/openclaw-secops

# Security-review classification, authorization, publication, and trusted API reads.
/.github/workflows/security-review.yml @openclaw/openclaw-secops
/scripts/github/dependency-guard.mjs @openclaw/openclaw-secops
/scripts/github/security-sensitive-guard.mjs @openclaw/openclaw-secops
/scripts/github/security-review.mjs @openclaw/openclaw-secops
/scripts/github/security-review-event.mjs @openclaw/openclaw-secops
/scripts/github/security-review-rollout.mjs @openclaw/openclaw-secops
/.github/security-review-policy.yml @openclaw/openclaw-secops
/.github/actions/setup-security-review/ @openclaw/openclaw-secops
/scripts/github/security-review-policy.mjs @openclaw/openclaw-secops
/scripts/github/guard-review.mjs @openclaw/openclaw-secops
/scripts/github/guard-shared.mjs @openclaw/openclaw-secops
/scripts/lib/bounded-response.mjs @openclaw/openclaw-secops

# Release workflow and its supporting release-path checks.
/.github/workflows/openclaw-npm-release.yml @openclaw/openclaw-release-managers
/docs/reference/RELEASING.md @openclaw/openclaw-release-managers
/scripts/openclaw-npm-publish.sh @openclaw/openclaw-release-managers
/scripts/openclaw-npm-release-check.ts @openclaw/openclaw-release-managers
/scripts/release-check.ts @openclaw/openclaw-release-managers
