From 23bde316519e640891d984f497beeee3bd5c9c01 Mon Sep 17 00:00:00 2001
From: damaz91 <federico.damato91@gmail.com>
Date: Thu, 16 Jul 2026 07:59:40 +0000
Subject: [PATCH] ci: add governance workflows and rules, remove CODEOWNERS

---
 .github/CODEOWNERS                            | 19 -------
 .github/workflows/governance.yml              | 35 ++++++++++++
 .github/workflows/pr-review-listener.yml      | 12 +++++
 org-tools/governance/rules/.github-rules.yml  | 54 +++++++++++++++++++
 .../rules/meeting-minutes-rules.yml           |  2 -
 5 files changed, 101 insertions(+), 21 deletions(-)
 delete mode 100644 .github/CODEOWNERS
 create mode 100644 .github/workflows/governance.yml
 create mode 100644 .github/workflows/pr-review-listener.yml
 create mode 100644 org-tools/governance/rules/.github-rules.yml

diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS
deleted file mode 100644
index 4fe42ce..0000000
--- a/.github/CODEOWNERS
+++ /dev/null
@@ -1,19 +0,0 @@
-# Universal Commerce Protocol (UCP) Organization-wide Codeowners
-
-# Default for all files (Automation & Shared Configs).
-*  @Universal-Commerce-Protocol/devops-maintainers
-
-# Infrastructure & Tooling
-/.github/                @Universal-Commerce-Protocol/devops-maintainers
-/renovate.json           @Universal-Commerce-Protocol/devops-maintainers
-/.pre-commit-config.yaml @Universal-Commerce-Protocol/devops-maintainers
-/.gitignore              @Universal-Commerce-Protocol/devops-maintainers
-
-# Governance - Managed by Governance Council.
-/GOVERNANCE.md           @Universal-Commerce-Protocol/governance-council
-/CONTRIBUTING.md         @Universal-Commerce-Protocol/governance-council
-/CODE_OF_CONDUCT.md      @Universal-Commerce-Protocol/governance-council
-/SECURITY.md             @Universal-Commerce-Protocol/governance-council
-/TC_ELECTIONS.md         @Universal-Commerce-Protocol/governance-council
-
-/.github/CODEOWNERS      @Universal-Commerce-Protocol/governance-council
diff --git a/.github/workflows/governance.yml b/.github/workflows/governance.yml
new file mode 100644
index 0000000..9aedeb8
--- /dev/null
+++ b/.github/workflows/governance.yml
@@ -0,0 +1,35 @@
+---
+name: PR Governance
+
+on:
+  pull_request_target:
+    types: [
+      opened, 
+      synchronize, 
+      reopened, 
+      ready_for_review, 
+      review_requested, 
+      review_request_removed, 
+      assigned, 
+      unassigned
+    ]
+  workflow_run:
+    workflows: ["PR Review Listener"]
+    types: [completed]
+
+jobs:
+  governance:
+    name: Reviews
+    permissions:
+      statuses: write
+      contents: read
+      pull-requests: read
+    # Use the reusable workflow defined in the central governance repository
+    # zizmor: ignore[ref-confusion]
+    uses: Universal-Commerce-Protocol/.github/.github/workflows/reusable-governance.yml@main
+    with:
+      pr-number: ${{ github.event.pull_request.number }}
+      commit-sha: ${{ github.event.pull_request.head.sha || github.event.workflow_run.head_sha }}
+    secrets:
+      # Required: An org-level Read token to read team memberships
+      ORG_READ_TOKEN: ${{ secrets.ORG_READ_TOKEN }}
diff --git a/.github/workflows/pr-review-listener.yml b/.github/workflows/pr-review-listener.yml
new file mode 100644
index 0000000..641e7a9
--- /dev/null
+++ b/.github/workflows/pr-review-listener.yml
@@ -0,0 +1,12 @@
+name: PR Review Listener
+on:
+  pull_request_review:
+    types: [submitted, dismissed]
+
+jobs:
+  signal:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Signal success
+        run: |
+          echo "PR ${{ github.event.pull_request.number }} review state changed."
diff --git a/org-tools/governance/rules/.github-rules.yml b/org-tools/governance/rules/.github-rules.yml
new file mode 100644
index 0000000..e307a20
--- /dev/null
+++ b/org-tools/governance/rules/.github-rules.yml
@@ -0,0 +1,54 @@
+# Target Repository: .github
+# Repository URL: https://github.com/Universal-Commerce-Protocol/.github
+---
+rules:
+  # ---------------------------------------------------------
+  # Governance
+  # ---------------------------------------------------------
+  - name: "governance"
+    patterns:
+      - "GOVERNANCE.md"
+      - "CONTRIBUTING.md"
+      - "CODE_OF_CONDUCT.md"
+      - "SECURITY.md"
+      - "TC_ELECTIONS.md"
+      - "LICENSE"
+      - "DOMAIN_TECH_COUNCIL_CHARTER.md"
+      - "MAINTAINERS.md"
+    requires:
+      # Strictly Governance Council (L4)
+      - team: "governance-council"
+        min_approvals: 2
+
+  # ---------------------------------------------------------
+  # Infrastructure, Tooling & Configuration (including org-tools)
+  # ---------------------------------------------------------
+  - name: "infra_and_tooling"
+    patterns:
+      - ".github/**"
+      - "renovate.json"
+      - ".pre-commit-config.yaml"
+      - ".gitignore"
+      - "org-tools/**"
+      - "pyproject.toml"
+      - "uv.lock"
+      - "README.md"
+    requires:
+      # Grants access to devops (L1) and higher
+      - min_team: "devops-maintainers"
+        min_approvals: 2
+
+fallback:
+  requires:
+    # Default for all files (*).
+    - min_team: "governance-council"
+      min_approvals: 2
+
+proxy_reviewers:
+  - amithanda
+
+team_hierarchy:
+  devops-maintainers: 1
+  maintainers: 2
+  tech-council: 3
+  governance-council: 4
diff --git a/org-tools/governance/rules/meeting-minutes-rules.yml b/org-tools/governance/rules/meeting-minutes-rules.yml
index 510bbb7..31864f4 100644
--- a/org-tools/governance/rules/meeting-minutes-rules.yml
+++ b/org-tools/governance/rules/meeting-minutes-rules.yml
@@ -47,8 +47,6 @@ rules:
       - "README.md"
       - "CONTRIBUTING.md"
       - "SECURITY.md"
-    excludes:
-      - ".github/CODEOWNERS"
     requires:
       # Grants access to devops (L1), maintainers (L2), tech-council (L3),
       # and governance-council (L4)