From 2c2c1c2996b809e1ac693f0f83e40bf06bb1ca8a Mon Sep 17 00:00:00 2001
From: qct-security-bot <security@qubic.li>
Date: Thu, 23 Jul 2026 13:37:00 +0000
Subject: [PATCH] security: add CODEOWNERS + workflow lint (post-2026-07-13
 hardening)

---
 .github/CODEOWNERS                   | 13 ++++++++++
 .github/workflows/lint-workflows.yml | 39 ++++++++++++++++++++++++++++
 2 files changed, 52 insertions(+)
 create mode 100644 .github/CODEOWNERS
 create mode 100644 .github/workflows/lint-workflows.yml

diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS
new file mode 100644
index 0000000..0d21251
--- /dev/null
+++ b/.github/CODEOWNERS
@@ -0,0 +1,13 @@
+# CODEOWNERS — reviewed by the workflow-security group for high-risk paths.
+# Docs: https://docs.github.com/en/repositories/managing-your-repositories-settings-and-security/customizing-your-repository/about-code-owners
+#
+# The workflow-security group reviews CI/CD attack surface. Domain reviewers
+# provide functional review via a separate CODEOWNERS entry per repo.
+
+# Workflow files and composite actions — mandatory review by workflow-security.
+/.github/workflows/         @qubic/workflow-security
+/.github/actions/           @qubic/workflow-security
+/.github/CODEOWNERS         @qubic/workflow-security
+
+# Repository-level automation config — mandatory review by workflow-security.
+/.github/dependabot.yml     @qubic/workflow-security
diff --git a/.github/workflows/lint-workflows.yml b/.github/workflows/lint-workflows.yml
new file mode 100644
index 0000000..1ff7a16
--- /dev/null
+++ b/.github/workflows/lint-workflows.yml
@@ -0,0 +1,39 @@
+name: Lint workflows
+
+on:
+  pull_request:
+    paths:
+      - '.github/workflows/**'
+      - '.github/actions/**'
+
+concurrency:
+  group: lint-workflows-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+jobs:
+  actionlint:
+    name: actionlint
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262  # v4
+        with:
+          persist-credentials: false
+      - name: Run actionlint
+        uses: reviewdog/action-actionlint@50842263c20a7c46bd0065b9e624d3c569db061e  # v1.73.0
+        with:
+          fail_on_error: true
+
+  zizmor:
+    name: zizmor
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262  # v4
+        with:
+          persist-credentials: false
+      - name: Run zizmor
+        uses: zizmorcore/zizmor-action@6599ee8b7a49aef6a770f63d261d214911a7ce02  # v0.6.0
+        with:
+          persona: auditor