.github: gate PRs via mitchellh/vouch

Auto-close PRs from authors not listed in .github/VOUCHED.td. Issues
stay open to everyone; the close message points contributors at
CONTRIBUTING.md. Maintainers manage the list with !vouch, !denounce
and !unvouch comments, and a weekly job resyncs CODEOWNERS.

The workflows use GITHUB_TOKEN with explicit least-privilege
permissions.

.github/CODEOWNERS

@@ -1,9 +1 @@
-* @juanfont @kradalby
-
-*.md @ohdearaugustin @nblock
-*.yml @ohdearaugustin @nblock
-*.yaml @ohdearaugustin @nblock
-Dockerfile* @ohdearaugustin @nblock
-.goreleaser.yml @ohdearaugustin @nblock
-/docs/ @ohdearaugustin @nblock
-/.github/workflows/ @ohdearaugustin @nblock
+* @juanfont @kradalby @nblock

.github/VOUCHED.td

@@ -0,0 +1,121 @@
+# Vouched (or actively denounced) users for this repository.
+#
+# Headscale gates pull requests to vouched contributors only. Issues
+# remain open to everyone — see CONTRIBUTING.md for the rationale and
+# the process for getting vouched.
+#
+# A denounced user (prefix `-`) is explicitly blocked from contributing.
+#
+# Syntax:
+#  - One handle per line (without @). Sorted alphabetically.
+#  - Optionally specify platform: `platform:username` (e.g., `github:nblock`).
+#  - To denounce, prefix with minus: `-username` or `-platform:username`.
+#  - Optionally, add a comment after a space following the handle.
+#
+# Maintainers can vouch for new contributors by commenting `!vouch` (or
+# `!vouch @username`) on any issue or PR by the author. `!denounce` blocks.
+
+aalmenar
+adoolaard
+adriangoransson
+Aluxima
+AlynxZhou
+apollo13
+aradng
+ArcticLampyrid
+arpitjain099
+bobelev
+ChibangLW
+christian-heusel
+ckiee
+codethief
+cure
+dmeremyanin
+dotlambda
+dragetd
+e-zk
+edvardvb
+enoperm
+EtaoinWu
+evenh
+eyJhb
+felixscheinost
+FlorinPeter
+fredrikekre
+griffer
+GrigoriyMikhalkin
+gymnae
+huskyii
+igrikus
+ImpostorKeanu
+isaac-mcfadyen
+iSchluff
+iSerganov
+ItalyPaleAle
+ItsShadowCone
+jdewinne
+joachimtingvold
+jonathanspw
+juanfont
+kazauwa
+korfuri
+kradalby
+linsomniac
+lyc8503
+madjam002
+majst01
+maprambo
+marcelmindemann
+maxpain
+mevansam
+mike-lloyd03
+motiejus
+mpldr
+nblock
+negbie
+Nemo157
+nicka101
+Niek
+nielscil
+NoelGisler
+noseshimself
+ohdearaugustin
+oplik0
+Orhideous
+pallabpain
+philippderdiedas
+Polsaker
+PowershellScripter
+ptman
+puzpuzpuz
+pvinis
+qbit
+QEDeD
+qoke
+Qup42
+redstonekasi
+restanrm
+reynico
+Riezebos
+samson4649
+SlackingVeteran
+spymobilfon
+stavros-k
+stblassitude
+SuperSandro2000
+SysAdminSmith
+sysvinit
+teleclimber
+tgrushka
+thebigbone
+tianon
+TotoTheDragon
+tsujamin
+unreality
+vbrandl
+vdovhanych
+victorhooi
+vsychov
+yaneony
+yaroslavkasatikov
+Zottelchen

.github/pr-unvouched-message

@@ -0,0 +1,25 @@
+Hi @{author}, thanks for your interest in headscale.
+
+Headscale gates pull requests to vouched contributors only. Your account
+isn't on the list yet, so this PR has been auto-closed. This is **not** a
+judgment of you or this change.
+
+Headscale is an "Open Source, acknowledged contribution" project: every
+contribution starts with a discussion on the issue tracker, **before** any
+code is written. See [`CONTRIBUTING.md`](https://github.com/juanfont/headscale/blob/main/CONTRIBUTING.md)
+for the full policy and the rationale.
+
+To get vouched:
+
+1. Open an issue describing the change you'd like to make (use case,
+   implementation sketch, who will maintain it). For bug fixes, a clear
+   reproduction is enough.
+2. Engage with maintainers on the issue. Once we've agreed on scope and
+   approach, a maintainer will `!vouch @{author}`.
+3. You can then reopen this PR (or open a new one) and it will pass the
+   gate.
+
+Issues remain open to everyone — no vouching needed there, and that's the
+intended starting point for any contribution.
+
+The vouched list: [`.github/VOUCHED.td`](https://github.com/juanfont/headscale/blob/main/.github/VOUCHED.td).

.github/workflows/vouch-check-pr.yml

@@ -0,0 +1,25 @@
+name: "Vouch - Check PR"
+
+on:
+  pull_request_target:
+    types: [opened, reopened]
+
+permissions:
+  contents: read
+  pull-requests: write
+
+jobs:
+  check:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+        with:
+          sparse-checkout: .github/pr-unvouched-message
+
+      - uses: mitchellh/vouch/action/check-pr@d66fa29a64600490892131ad87597c30c91fcac4 # v1.5.0
+        with:
+          pr-number: ${{ github.event.pull_request.number }}
+          auto-close: true
+          template-file: .github/pr-unvouched-message
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/vouch-manage-by-issue.yml

@@ -0,0 +1,33 @@
+name: "Vouch - Manage by Issue"
+
+on:
+  issue_comment:
+    types: [created]
+
+permissions:
+  contents: write
+  issues: write
+  pull-requests: write
+
+concurrency:
+  group: vouch-manage
+  cancel-in-progress: false
+
+jobs:
+  manage:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+
+      - uses: mitchellh/vouch/action/manage-by-issue@d66fa29a64600490892131ad87597c30c91fcac4 # v1.5.0
+        with:
+          repo: ${{ github.repository }}
+          issue-id: ${{ github.event.issue.number }}
+          comment-id: ${{ github.event.comment.id }}
+          vouch-keyword: "!vouch"
+          denounce-keyword: "!denounce"
+          unvouch-keyword: "!unvouch"
+          pull-request: "true"
+          merge-immediately: "true"
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/vouch-sync-codeowners.yml

@@ -0,0 +1,28 @@
+name: "Vouch - Sync CODEOWNERS"
+
+on:
+  schedule:
+    - cron: "0 0 * * 1"
+  workflow_dispatch:
+
+permissions:
+  contents: write
+  pull-requests: write
+
+concurrency:
+  group: vouch-manage
+  cancel-in-progress: false
+
+jobs:
+  sync:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+
+      - uses: mitchellh/vouch/action/sync-codeowners@d66fa29a64600490892131ad87597c30c91fcac4 # v1.5.0
+        with:
+          repo: ${{ github.repository }}
+          pull-request: "true"
+          merge-immediately: "true"
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}