# Sensitive automation, release, and runtime ownership
# Package manifests intentionally stay outside CODEOWNERS so the safe Dependabot
# lane can auto-approve only dev-only npm minor/patch manifest updates after the
# required checks pass.
/.github/ @markusleben
# Workflow files are un-owned (later match wins) so the Dependabot actions lane
# can auto-merge uses:-only minor/patch bumps; the diff guard in
# dependabot-safe-lane-prepare.yml rejects any workflow change beyond uses:
# lines, and all required checks plus the 1-review rule still apply.
/.github/workflows/
# These source/release gates execute protected evidence or control publication.
# They must always receive maintainer review; the later exact matches restore
# ownership without disabling the uses:-only Dependabot lane for other workflows.
/.github/workflows/cloud-source-gate.yml @markusleben
/.github/workflows/cloud-candidate-bundle.yml @markusleben
/.github/workflows/ci.yml @markusleben
/.github/workflows/release.yml @markusleben
/.github/workflows/release-candidate.yml @markusleben
/.claude-plugin/ @markusleben
/.goreleaser.yml @markusleben
/install.sh @markusleben
/install.ps1 @markusleben
/version.json @markusleben
/clients/ @markusleben
/cli/ @markusleben
/hooks/ @markusleben
/nova/ @markusleben
# Un-own the nova package manifests (later match wins) so the safe Dependabot
# lane stays automatic for /nova dev-only minor/patch bumps, matching the root
# manifests above.
/nova/package.json
/nova/package-lock.json

# Core project areas
/skills/ @markusleben
/scripts/ @markusleben
/tests/ @markusleben
/docs/reference/ @markusleben
/docs/releasing.md @markusleben
/README.md @markusleben
/PROJECT.md @markusleben
