How do you protect workflow and release files with CODEOWNERS?

Add a CODEOWNERS file that assigns your workflow folder, release configuration and the CODEOWNERS file itself to trusted reviewers, then turn on required code owner review in branch protection or a ruleset. Then nobody can change how your project publishes without a second set of eyes.

Why release files deserve their own owner

A change to a workflow file can alter who can publish, which secrets are used and which actions run. That is more power than most source edits carry. GitHub's hardening guide recommends adding the workflows directory to the code owners list so changes first need approval from a designated reviewer.

How CODEOWNERS works

From the GitHub documentation:

• The file lives in .github/, the repository root or docs/. GitHub uses the first one it finds in that order.
• It must be on the pull request's base branch.
• Owners can be users, teams in @org/team form, or email addresses, and each needs explicit write access.
• The last matching pattern wins, so order matters.
• Put multiple owners on one line. Owners on separate lines for the same pattern do not combine.
• The file must be under 3 MB, or it is not loaded.
• Owners are not requested on draft pull requests.

A starter file

# Default owner for everything
*                       @example-org/maintainers

# Release and CI paths need the release owners
/.github/workflows/     @example-org/release-owners
/.github/CODEOWNERS     @example-org/release-owners
/package.json           @example-org/release-owners
/scripts/release/       @example-org/release-owners

Because the last match wins, the specific paths go below the catch all line. The CODEOWNERS file protects itself in the last sections, as the documentation suggests, so a change to ownership also needs review.

Enforcement is separate from the file

The file only requests reviews. To require them, enable Require review from Code Owners in branch protection, or use a ruleset. Approval from any one listed owner satisfies the requirement. See branch protection rules versus rulesets for choosing between them.

Solo maintainer caveat

If you are the only maintainer, you cannot approve your own pull request, so a required review would block you. Options include inviting a trusted second owner, or using the pattern in two person review when you are the only maintainer.

Checklist

1. Create .github/CODEOWNERS.
2. Cover workflows, the release script, package manifests and the file itself.
3. Make sure owners have write access and teams are visible.
4. Enable code owner review in a ruleset.
5. Test with a throwaway pull request that edits a workflow.

Safeguard can add gates on pull requests too, and the free scan at gold.safeguard.sh/scan checks your dependencies.

Quick check

Sources

• GitHub Docs: About code owners
• GitHub Docs: Secure use reference

Last reviewed: 19 October 2026.