Attackers often try to merge malicious workflow changes. Which control requires designated owners to approve changes under '.github/workflows'?
Select an answer to reveal the explanation.
Short Explanation and Infographic
CODEOWNERS plus branch protection/rulesets requiring owner review gates workflow YAML changes—a critical security control plane.
Full explanation below image
Full Explanation
Workflow files are executable infrastructure. CODEOWNERS can assign security or platform teams as required reviewers for .github/workflows/** when branch protection enforces code owner reviews. timeout-minutes and runner OS choices do not review code. Disabling checkout breaks most CI. Also consider rulesets, required status checks, and restricting who can approve environment deployments. Audit workflow diffs carefully for exfiltration steps and expanded permissions.