# Defining who has to review changes to what files.
# Try to keep the entries sorted alphabetically, so they end up in the same order as
# they would if you listed the entire repository as a tree.
#
# This enforcement is to protect certain important files from being changed without the approval
# of team leads. For more fine grained code ownership assignments to teams, see
# `/code-owners.json` and `/.github/workflows/code-owner-approval.yml`.

# Container images used for building the app are owned by respective team leads and tech lead
/building/android-container-image.txt @linus-mullvad @albin-mullvad @rawa
/building/linux-container-image.txt @linus-mullvad @raksooo @tobias-jarvelov

# Developer signing keys must be approved by team/tech leads
/ci/keys/ @linus-mullvad @raksooo @pinkisemils @rawa
/mullvad-update/trusted-metadata-signing-pubkeys @linus-mullvad @raksooo @pinkisemils @rawa

# Desktop build server files owned by desktop leads
/ci/buildserver* @linus-mullvad @raksooo @tobias-jarvelov
/ci/linux-repository-builder/ @linus-mullvad @raksooo @tobias-jarvelov

# Android build server files owned by android
/ci/android/** @linus-mullvad @rawa @albin-mullvad

# Desktop release config specifying code signing key fingerprint
/desktop/scripts/release/release-config.sh

# Cargo deny config must be approved by tech lead or desktop team lead
**/deny.toml @linus-mullvad @raksooo @tobias-jarvelov

# Changes to what CVEs are ignored must be approved by leads
**/osv-scanner.toml @linus-mullvad @raksooo @pinkisemils @albin-mullvad @rawa @tobias-jarvelov
/.github/workflows/osv-scanner*.yml @linus-mullvad @raksooo @pinkisemils @rawa @tobias-jarvelov

# Security related github action workflow changes must be approved by leads
/.github/workflows/verify-locked-down-signatures.yml @linus-mullvad @raksooo @pinkisemils @rawa
/ci/verify-locked-down-signatures.sh @linus-mullvad @raksooo @pinkisemils @rawa
/.github/workflows/unicop.yml @linus-mullvad @raksooo @pinkisemils @rawa

# Our own code ownership mapping and automation must be approved by leads
/.github/workflows/code-owner-approval.yml @linus-mullvad @raksooo @pinkisemils @rawa @tobias-jarvelov
/code-owners.json @linus-mullvad @raksooo @pinkisemils @rawa @tobias-jarvelov

# The CODEOWNERS itself must be protected from unauthorized changes,
# otherwise the protection becomes quite moot.
# Keep this entry last, so it is sure to override any existing previous wildcard match
/.github/CODEOWNERS @linus-mullvad @raksooo @pinkisemils @rawa
