# Supply-chain-sensitive paths only. Ownership here + the main ruleset's
# "require code owner review" means PRs touching these paths need explicit
# approval before (auto)merge, while dependency PRs keep automerging.
#
# Deliberately no "*" rule -- owning everything would gate every renovate PR
# and kill automerge.

# Workflows, CODEOWNERS itself, and repo automation
/.github/ @svange

# Renovate config controls what automerges
/renovate.json5 @svange

# Pre-commit hooks execute arbitrary code in CI (renovate automerges bumps)
/.pre-commit-config.yaml @svange
