ci: updated for best practices

.github/CODEOWNERS

@@ -1,2 +1,29 @@
 # Default code owners for entire repository
-*   @SimiHunjan @ochikov @petreze
+*   @SimiHunjan @ochikov @petreze @hashgraph/release-engineering @hashgraph/release-engineering-managers
+
+#########################
+#####  Core Files  ######
+#########################
+
+# NOTE: Must be placed last to ensure enforcement over all other rules
+
+# Protection Rules for Github Configuration Files and Actions Workflows
+/.github/                                       @hashgraph/release-engineering @hashgraph/release-engineering-managers
+
+# Codacy Tool Configurations
+/config/                                        @hashgraph/release-engineering @hashgraph/release-engineering-managers
+.remarkrc                                       @hashgraph/release-engineering @hashgraph/release-engineering-managers
+
+# Self-protection for root CODEOWNERS files (this file should not exist and should definitely require approval)
+/CODEOWNERS                                      @hashgraph/release-engineering @hashgraph/release-engineering-managers
+
+# Protect the repository root files
+/README.md                                      @hashgraph/release-engineering @hashgraph/release-engineering-managers
+**/LICENSE                                      @hashgraph/release-engineering @hashgraph/release-engineering-managers
+
+# CodeCov configuration
+**/codecov.yml                                  @hashgraph/release-engineering @hashgraph/release-engineering-managers
+
+# Git Ignore definitions
+**/.gitignore                                   @hashgraph/release-engineering @hashgraph/release-engineering-managers
+**/.gitignore.*                                 @hashgraph/release-engineering @hashgraph/release-engineering-managers

.github/workflows/react_native.yml

@@ -13,12 +13,17 @@ on:
       - develop
       - release/*
 
+defaults:
+    run:
+        shell: bash
+
 permissions:
   contents: read
 
 jobs:
   android:
     name: Android
+    # runs-on: [ self-hosted, Linux, medium, ephemeral ]  # this will be enabled once we configure a self-hosted runner
     runs-on: macos-latest
     steps:
       - name: Checkout Code
@@ -75,6 +80,7 @@ jobs:
 
   ios:
     name: iOS
+    # runs-on: [ self-hosted, Linux, medium, ephemeral ]  # this will be enabled once we configure a self-hosted runner
     runs-on: macos-latest
     steps:
       - name: Checkout Code

.github/workflows/renovate.yml

@@ -4,6 +4,7 @@ on:
     # The "*" (#42, asterisk) character has special semantics in YAML, so this
     # string has to be quoted.
     - cron: '0 0 * * 0'
+  workflow_dispatch:
 
 defaults:
   run:
@@ -14,7 +15,7 @@ permissions:
 
 jobs:
   renovate:
-    runs-on: ubuntu-latest
+    runs-on: [ self-hosted, Linux, medium, ephemeral ]
     steps:
       - name: Checkout Code
         uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1