ci: add ci-reviewed label gate for CI-sensitive files

.github/workflows/ci.yml

@@ -43,6 +43,7 @@ jobs:
       deps: ${{ steps.classify.outputs.deps }}
       docker_meta: ${{ steps.classify.outputs.docker_meta }}
       mcp_catalog: ${{ steps.classify.outputs.mcp_catalog }}
+      ci_review: ${{ steps.classify.outputs.ci_review }}
       event_name: ${{ github.event_name }}
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
@@ -65,10 +66,11 @@ jobs:
   lint:
     name: Python lints
     needs: detect
-    if: needs.detect.outputs.python == 'true'
+    if: needs.detect.outputs.python == 'true' || needs.detect.outputs.ci_review == 'true'
     uses: ./.github/workflows/lint.yml
     with:
       event_name: ${{ needs.detect.outputs.event_name }}
+      ci_review: ${{ needs.detect.outputs.ci_review == 'true' }}
 
   js-tests:
     name: JS & TS checks

.github/workflows/lint.yml

@@ -15,6 +15,10 @@ on:
         description: The event name from the calling orchestrator (pull_request or push).
         type: string
         required: true
+      ci_review:
+        description: Whether CI-sensitive files (eslint config, workflows, actions) changed and require a review label.
+        type: boolean
+        default: false
 
 permissions:
   contents: read
@@ -158,3 +162,111 @@ jobs:
 
       - name: Run footgun checker
         run: python scripts/check-windows-footguns.py --all
+
+  ci-review:
+    # Require explicit maintainer review when CI-sensitive files change:
+    # eslint config, workflow YAMLs, or composite actions. These files
+    # influence what code the desktop-autofix job executes and pushes to
+    # main, so a malicious PR could inject arbitrary code via a custom eslint
+    # rule's `fix` function. The label gate ensures a human reviews before
+    # merge. Mirrors the mcp-catalog-reviewed pattern in supply-chain-audit.yml.
+    name: CI-sensitive file review
+    if: inputs.event_name == 'pull_request' && inputs.ci_review
+    runs-on: ubuntu-latest
+    timeout-minutes: 2
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - name: Require ci-reviewed label
+        id: label-check
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          set -euo pipefail
+          PR="${{ github.event.pull_request.number }}"
+          LABELS=$(gh pr view "$PR" --json labels --jq '.labels[].name' || true)
+          if echo "$LABELS" | grep -Fxq 'ci-reviewed'; then
+            echo "reviewed=true" >> "$GITHUB_OUTPUT"
+            echo "ci-reviewed label present."
+            exit 0
+          fi
+          echo "reviewed=false" >> "$GITHUB_OUTPUT"
+
+      # On failure: find the bot's previous comment and edit it, or create
+      # a new one if none exists. Using an HTML comment marker so we can
+      # locate it reliably across runs without parsing the body text.
+      # Skipped on fork PRs — GITHUB_TOKEN is read-only there, so the API
+      # call would fail. The label gate still holds via the step below.
+      - name: Post or update review warning
+        if: steps.label-check.outputs.reviewed != 'true' && github.event.pull_request.head.repo.fork != true
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          set -euo pipefail
+          PR="${{ github.event.pull_request.number }}"
+          MARKER="<!-- ci-review-bot -->"
+          BODY="${MARKER}
+          ## ⚠️ CI-sensitive file review required
+
+          This PR changes CI-sensitive files (eslint config, workflow YAMLs,
+          or composite actions). These files influence what code the
+          desktop-autofix job executes and pushes to main.
+
+          A maintainer should verify:
+          - no new eslint rules with custom \`fix\` functions that write outside linted paths,
+          - no workflow changes that widen permissions or remove guards,
+          - no composite action changes that alter what gets executed.
+
+          After review, add the \`ci-reviewed\` label and re-run this check."
+
+          # Find an existing comment with our marker.
+          COMMENT_ID=$(gh api \
+            "repos/${{ github.repository }}/issues/${PR}/comments" \
+            --paginate --jq ".[] | select(.body | contains(\"${MARKER}\")) | .id" \
+            | head -1 || true)
+
+          if [ -n "$COMMENT_ID" ]; then
+            gh api --method PATCH \
+              "repos/${{ github.repository }}/issues/comments/${COMMENT_ID}" \
+              -f body="$BODY"
+          else
+            gh pr comment "$PR" --body "$BODY"
+          fi
+
+      # Fail the job when the label is missing — always runs (including
+      # fork PRs) so the security gate holds even when the comment step
+      # was skipped above.
+      - name: Fail on missing label
+        if: steps.label-check.outputs.reviewed != 'true'
+        run: |
+          echo "::error::CI-sensitive changes require the ci-reviewed label."
+          exit 1
+
+      # On success: if a previous warning comment exists, edit it to show
+      # the review passed so the PR doesn't have a stale ⚠️ sitting around.
+      # Skipped on fork PRs — no comment was ever posted to update.
+      - name: Update previous warning to passed
+        if: steps.label-check.outputs.reviewed == 'true' && github.event.pull_request.head.repo.fork != true
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          set -euo pipefail
+          PR="${{ github.event.pull_request.number }}"
+          MARKER="<!-- ci-review-bot -->"
+
+          # Find an existing comment with our marker.
+          COMMENT_ID=$(gh api \
+            "repos/${{ github.repository }}/issues/${PR}/comments" \
+            --paginate --jq ".[] | select(.body | contains(\"${MARKER}\")) | .id" \
+            | head -1 || true)
+
+          if [ -n "$COMMENT_ID" ]; then
+            BODY="${MARKER}
+          ## ✅ CI-sensitive file review passed
+
+          The \`ci-reviewed\` label is present on this PR."
+
+            gh api --method PATCH \
+              "repos/${{ github.repository }}/issues/comments/${COMMENT_ID}" \
+              -f body="$BODY"
+          fi