From b46ca9e11278a6aaa25b38842577c700e156a6b8 Mon Sep 17 00:00:00 2001
From: jon <nikuscs@gmail.com>
Date: Tue, 12 May 2026 10:59:18 +0100
Subject: [PATCH 1/2] chore: harden GitHub Actions controls

---
 .github/workflows/ci.yml      | 19 +++++++++++++++----
 .github/workflows/release.yml | 17 +++++++++++++++--
 2 files changed, 30 insertions(+), 6 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index e3bbe65..ca66dea 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -10,6 +10,9 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
+permissions:
+  contents: read
+
 env:
   CARGO_TERM_COLOR: always
   RUSTFLAGS: -Dwarnings
@@ -18,9 +21,11 @@ jobs:
   check:
     name: Check
     runs-on: ubuntu-latest
-    if: "!contains(github.event.head_commit.message, '[skip ci]')"
+    if: (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository) && (github.event_name != 'push' || !contains(github.event.head_commit.message, '[skip ci]'))
     steps:
       - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
       - uses: dtolnay/rust-toolchain@stable
       - uses: Swatinem/rust-cache@v2
       - run: cargo check --all-targets
@@ -28,9 +33,11 @@ jobs:
   fmt:
     name: Format
     runs-on: ubuntu-latest
-    if: "!contains(github.event.head_commit.message, '[skip ci]')"
+    if: (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository) && (github.event_name != 'push' || !contains(github.event.head_commit.message, '[skip ci]'))
     steps:
       - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
       - uses: dtolnay/rust-toolchain@stable
         with:
           components: rustfmt
@@ -39,9 +46,11 @@ jobs:
   clippy:
     name: Clippy
     runs-on: ubuntu-latest
-    if: "!contains(github.event.head_commit.message, '[skip ci]')"
+    if: (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository) && (github.event_name != 'push' || !contains(github.event.head_commit.message, '[skip ci]'))
     steps:
       - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
       - uses: dtolnay/rust-toolchain@stable
         with:
           components: clippy
@@ -51,9 +60,11 @@ jobs:
   test:
     name: Test
     runs-on: ubuntu-latest
-    if: "!contains(github.event.head_commit.message, '[skip ci]')"
+    if: (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository) && (github.event_name != 'push' || !contains(github.event.head_commit.message, '[skip ci]'))
     steps:
       - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
       - uses: dtolnay/rust-toolchain@stable
       - uses: Swatinem/rust-cache@v2
       - run: cargo test
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 501f4eb..69fc7c5 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -17,8 +17,7 @@ concurrency:
   group: release
   cancel-in-progress: false
 
-permissions:
-  contents: write
+permissions: {}
 
 env:
   CARGO_TERM_COLOR: always
@@ -29,6 +28,8 @@ jobs:
   checks:
     name: Checks
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     steps:
       - uses: actions/checkout@v4
       - uses: dtolnay/rust-toolchain@stable
@@ -46,6 +47,9 @@ jobs:
     name: Create Tag
     needs: checks
     runs-on: ubuntu-latest
+    environment: production
+    permissions:
+      contents: write
     outputs:
       version: ${{ steps.bump.outputs.version }}
       tag: ${{ steps.bump.outputs.tag }}
@@ -118,6 +122,8 @@ jobs:
     name: Build (${{ matrix.target }})
     needs: create-tag
     runs-on: ${{ matrix.os }}
+    permissions:
+      contents: read
     strategy:
       matrix:
         include:
@@ -172,6 +178,10 @@ jobs:
     name: Create Release
     needs: [create-tag, build]
     runs-on: ubuntu-latest
+    environment: production
+    permissions:
+      contents: write
+      pull-requests: read
     steps:
       - name: Checkout
         uses: actions/checkout@v4
@@ -247,6 +257,9 @@ jobs:
     needs: [create-tag, build]
     if: failure() && needs.create-tag.result == 'success'
     runs-on: ubuntu-latest
+    environment: production
+    permissions:
+      contents: write
     steps:
       - name: Checkout
         uses: actions/checkout@v4

From b5fc20076a79a64787bdc52f216ff77f0c2a8b53 Mon Sep 17 00:00:00 2001
From: jon <nikuscs@gmail.com>
Date: Tue, 12 May 2026 11:27:44 +0100
Subject: [PATCH 2/2] chore: add codeowners

---
 .github/CODEOWNERS | 7 +++++++
 1 file changed, 7 insertions(+)
 create mode 100644 .github/CODEOWNERS

diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS
new file mode 100644
index 0000000..e935d22
--- /dev/null
+++ b/.github/CODEOWNERS
@@ -0,0 +1,7 @@
+/.github/ @nikuscs
+/Cargo.toml @nikuscs
+/Cargo.lock @nikuscs
+/rustfmt.toml @nikuscs
+/config.example.toml @nikuscs
+/migrations/ @nikuscs
+/src/ @nikuscs