fix(codeowners): cover the tests and the SBOM check

The gate's tests are part of its enforcement surface: weakening an
assertion is the quietest way to let a later change to the gate pass
unnoticed. verify-image-sbom.sh decides whether a published image may
ship without an SBOM describing the Rust code inside it, so it belongs
under the same ownership even though it gates releases, not merges.

Regroups the block by what each rule protects and restates why the
outside maintainers are spelled out alongside the team.

Signed-off-by: Jim Meyer <jimeyer@nvidia.com>

Author: purp

.github/CODEOWNERS

@@ -1,29 +1,35 @@
-# Broad ownership — core team reviews everything
+## Broad ownership — core team reviews everything
 * @NVIDIA/openshell-codeowners @mrunalp @sjenning @derekwaynecarr
 
-# Vouch list — maintainers only (bot commits bypass, but manual edits need review)
+## Vouch list — maintainers only (bot commits bypass, but manual edits need review)
 .github/VOUCHED.td @NVIDIA/openshell-codeowners
 
-# Merge enforcement — these paths decide who can merge, so they keep an explicit
-# owner independent of any broad ownership rule above.
-#
-# A workflow triggered by pull_request_review runs the pull request's copy of
-# the workflow file, not the one on main, so a contributor can rewrite the
-# approval gate in the same pull request the gate is meant to block. Requiring
-# a code owner here is what closes that: the tampered job still runs and still
-# reports green, but the pull request cannot merge without an approval GitHub
-# enforces natively.
+## Merge enforcement — these paths decide who can merge, so they notify the full
+# list of maintainers to raise scrutiny on changes here.
+# 
+# PR checks run local to the branch, so unless the check specifically avoids
+# using branch-local files, a PR could change its own gates and appear to pass
+# them. Covering the required checks here closes that gap.
 #
 # The whole workflows directory is covered, not just the approval gate, because
 # any workflow can claim a required check context or ask for a broader token.
 #
-# The three logins are named alongside the team because they are outside
-# collaborators and cannot join it. Owning these paths by team alone would mean
-# no Red Hat maintainer could approve a change to the merge gate.
+# Normally, we'd use a GitHub team to cover all maintainers, but org-level
+# policies prevent outside collaborators from being on a GH team at this time
+# so we spell them out explicitly.
+
+# Core check mechanisms
 /.github/workflows/ @NVIDIA/openshell-codeowners @mrunalp @sjenning @derekwaynecarr
 /.github/actions/ @NVIDIA/openshell-codeowners @mrunalp @sjenning @derekwaynecarr
 /.github/CODEOWNERS @NVIDIA/openshell-codeowners @mrunalp @sjenning @derekwaynecarr
 /.github/zizmor.yml @NVIDIA/openshell-codeowners @mrunalp @sjenning @derekwaynecarr
+
+# `MAINTAINERS.md` maintainer approval checks
 /MAINTAINERS.md @NVIDIA/openshell-codeowners @mrunalp @sjenning @derekwaynecarr
 /tasks/scripts/check_maintainer_approval.py @NVIDIA/openshell-codeowners @mrunalp @sjenning @derekwaynecarr
 /tasks/scripts/alert_maintainer_change.py @NVIDIA/openshell-codeowners @mrunalp @sjenning @derekwaynecarr
+/tasks/scripts/check_maintainer_approval_test.py @NVIDIA/openshell-codeowners @mrunalp @sjenning @derekwaynecarr
+/tasks/scripts/alert_maintainer_change_test.py @NVIDIA/openshell-codeowners @mrunalp @sjenning @derekwaynecarr
+
+# Auditable SBOM check
+/tasks/scripts/verify-image-sbom.sh @NVIDIA/openshell-codeowners @mrunalp @sjenning @derekwaynecarr

CONTRIBUTING.md

@@ -70,7 +70,7 @@ Use agents and the repository skills as needed to understand the affected code,
 
 Every pull request must be approved by someone listed in [MAINTAINERS.md](MAINTAINERS.md) before it can merge. This is enforced by the `OpenShell / Maintainer Approval` status check, which turns green once one of those reviewers approves. Reviews from other contributors are welcome and count toward the general approval requirement, but they do not satisfy this check.
 
-Pull requests that touch the enforcement machinery itself — anything under `.github/workflows/`, `.github/actions/`, `MAINTAINERS.md`, `.github/CODEOWNERS`, or the approval helpers in `tasks/scripts/` — additionally require a code owner's approval, listed in [.github/CODEOWNERS](.github/CODEOWNERS). The status check reads its inputs from `main`, but a workflow triggered by a review runs the pull request's own copy of the workflow file, so GitHub's native code owner requirement is what keeps a change from disabling the gate that would have blocked it.
+Pull requests that touch the enforcement machinery itself — anything under `.github/workflows/`, `.github/actions/`, `MAINTAINERS.md`, `.github/CODEOWNERS`, or the enforcement scripts in `tasks/scripts/` — additionally require a code owner's approval, listed in [.github/CODEOWNERS](.github/CODEOWNERS). The status check reads its inputs from `main`, but a workflow triggered by a review runs the pull request's own copy of the workflow file, so GitHub's native code owner requirement is what keeps a change from disabling the gate that would have blocked it.
 
 Maintainers are not requested automatically. If your pull request has been idle, ask for a reviewer in the pull request or in the CNCF Slack channel rather than waiting.