From 59fe705f91042acba8091909f08cf75f8d30e23b Mon Sep 17 00:00:00 2001
From: onspeedhp <chaukhac4@gmail.com>
Date: Wed, 6 May 2026 22:39:41 +0700
Subject: [PATCH] chore(repo): add CODEOWNERS, PR template, dependabot config

- CODEOWNERS: every change touches admins by default (@onspeedhp,
  @chauanhtuan185, @metasal1); audit-sensitive paths (program/, assertions/,
  .github/workflows/, audits/) and the cherry-pick guardrails (fee-paths.txt
  + strip-fee.sh + check-no-fee.sh) re-state the same owners explicitly
  so renames don't silently drop ownership rules.
- PULL_REQUEST_TEMPLATE.md: includes a 'Cherry-pick provenance' section so
  cherry-picks from lazorkit-protocol leave an audit trail and confirm
  scripts/check-no-fee.sh passed.
- dependabot.yml: monthly cadence per ecosystem (cargo workspace, tests-sdk
  npm, github-actions). Groups version + security updates separately so a
  security PR doesn't get held up behind feature bumps.
---
 .github/CODEOWNERS               | 19 ++++++++++++++
 .github/PULL_REQUEST_TEMPLATE.md | 43 ++++++++++++++++++++++++++++++++
 .github/dependabot.yml           | 42 +++++++++++++++++++++++++++++++
 3 files changed, 104 insertions(+)
 create mode 100644 .github/CODEOWNERS
 create mode 100644 .github/PULL_REQUEST_TEMPLATE.md
 create mode 100644 .github/dependabot.yml

diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS
new file mode 100644
index 0000000..31e4ce5
--- /dev/null
+++ b/.github/CODEOWNERS
@@ -0,0 +1,19 @@
+# Code owners for lazor-kit/program-v2
+#
+# Order matters — the LAST matching pattern wins. Use specific
+# overrides below the catch-all when you want to scope ownership.
+#
+# Reference: https://docs.github.com/en/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/about-code-owners
+
+# Default: any change requires review from one of the maintainers
+*                       @onspeedhp @chauanhtuan185 @metasal1
+
+# Audit-sensitive paths — additional eyes on changes that affect on-chain
+# behavior or release artifacts
+/program/               @onspeedhp @chauanhtuan185 @metasal1
+/assertions/            @onspeedhp @chauanhtuan185 @metasal1
+/.github/workflows/     @onspeedhp @chauanhtuan185 @metasal1
+/audits/                @onspeedhp @chauanhtuan185 @metasal1
+/scripts/fee-paths.txt  @onspeedhp @chauanhtuan185 @metasal1
+/scripts/strip-fee.sh   @onspeedhp @chauanhtuan185 @metasal1
+/scripts/check-no-fee.sh @onspeedhp @chauanhtuan185 @metasal1
diff --git a/.github/PULL_REQUEST_TEMPLATE.md b/.github/PULL_REQUEST_TEMPLATE.md
new file mode 100644
index 0000000..407d492
--- /dev/null
+++ b/.github/PULL_REQUEST_TEMPLATE.md
@@ -0,0 +1,43 @@
+<!--
+Keep this short. The squash-merge commit body uses the PR description, so
+prose written here ends up in `git log`. Aim for what a reviewer (or your
+future self bisecting) needs to understand the change.
+
+If this PR cherry-picks from `lazorkit-protocol`: cite the upstream
+commit / PR and confirm `bash scripts/check-no-fee.sh` passes.
+-->
+
+## Summary
+
+<!-- 1–3 bullets: what this PR does and the user-visible reason. -->
+
+## Changes
+
+<!-- Per-file or per-area highlights. Skip if `Summary` already covers it. -->
+
+## Test plan
+
+- [ ] CI passes (`check-no-fee`, `sbf-cluster-check`)
+- [ ] `cargo test --features devnet` passes
+- [ ] `cargo build-sbf --features devnet` and `--features mainnet` both build
+- [ ] `npm test` in `tests-sdk` (against a live validator) passes
+- [ ] Updates docs / CHANGELOG when public behavior changes
+
+## Audit / security notes
+
+<!-- Skip if N/A. Otherwise: error codes touched, account layout changes,
+authority/auth flow changes, vault-invariant defenses, anything that
+needs Accretion follow-up. Note new entries against the
+`audit-baseline-*` tag. -->
+
+## Cherry-pick provenance (if applicable)
+
+<!-- Upstream commit / PR being mirrored from lazorkit-protocol, plus
+confirmation that the fee surface was correctly stripped:
+- [ ] `bash scripts/check-no-fee.sh` clean
+- [ ] No symbols added that match `scripts/fee-paths.txt`
+-->
+
+## Related
+
+<!-- Linked issues, prior PRs, audit findings, design docs. -->
diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 0000000..ef5f15c
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,42 @@
+# Dependabot config — keep noise low, group updates, monthly cadence.
+# Reference: https://docs.github.com/en/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file
+version: 2
+updates:
+  # Cargo workspace (program + assertions + no-padding)
+  - package-ecosystem: "cargo"
+    directory: "/"
+    schedule:
+      interval: "monthly"
+    open-pull-requests-limit: 3
+    groups:
+      cargo-deps:
+        applies-to: version-updates
+        patterns: ["*"]
+      cargo-security:
+        applies-to: security-updates
+        patterns: ["*"]
+    commit-message:
+      prefix: "chore(deps)"
+
+  # Test harness (uses @lazorkit/sdk-legacy from npm)
+  - package-ecosystem: "npm"
+    directory: "/tests-sdk"
+    schedule:
+      interval: "monthly"
+    open-pull-requests-limit: 3
+    groups:
+      tests-deps:
+        applies-to: version-updates
+        patterns: ["*"]
+    commit-message:
+      prefix: "chore(deps-dev)"
+      include: "scope"
+
+  # GitHub Actions used in workflows
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "monthly"
+    open-pull-requests-limit: 2
+    commit-message:
+      prefix: "ci(deps)"