Add CODEOWNERS authorization check to Python publish workflow

.github/workflows/publish-python-package.yml

@@ -33,6 +33,75 @@ jobs:
       - name: Checkout code
         uses: actions/checkout@v4
 
+      - name: Authorize actor against CODEOWNERS
+        env:
+          ACTOR: ${{ github.actor }}
+          PACKAGE: ${{ inputs.package }}
+        run: |
+          node << 'SCRIPT'
+          const fs = require('fs');
+          const actor = process.env.ACTOR;
+          const pkg = process.env.PACKAGE;
+
+          // Parse CODEOWNERS
+          const lines = fs.readFileSync('.github/CODEOWNERS', 'utf-8').split('\n');
+          const rules = [];
+          let rootOwners = [];
+
+          for (const line of lines) {
+            const trimmed = line.trim();
+            if (!trimmed || trimmed.startsWith('#')) continue;
+            const parts = trimmed.split(/\s+/);
+            const pattern = parts[0];
+            const owners = parts.slice(1).map(o => o.replace('@', ''));
+            if (pattern === '*') {
+              rootOwners = owners;
+            } else {
+              rules.push({ pattern, owners });
+            }
+          }
+
+          // Find the most specific matching rule for this package path
+          // Strip trailing /python to match CODEOWNERS entries like "integrations/adk-middleware"
+          const pathsToCheck = [pkg];
+          const pythonSuffix = '/python';
+          if (pkg.endsWith(pythonSuffix)) {
+            pathsToCheck.push(pkg.slice(0, -pythonSuffix.length));
+          }
+
+          let authorized = false;
+          let matchedRule = null;
+
+          for (const checkPath of pathsToCheck) {
+            for (const rule of rules) {
+              const pattern = rule.pattern.replace(/\/$/, '');
+              if (checkPath === pattern || checkPath.startsWith(pattern + '/')) {
+                matchedRule = rule;
+                authorized = rule.owners.includes(actor);
+                break;
+              }
+            }
+            if (matchedRule) break;
+          }
+
+          // Fall back to root owners if no specific rule matched
+          if (!matchedRule) {
+            matchedRule = { pattern: '*', owners: rootOwners };
+            authorized = rootOwners.includes(actor);
+          }
+
+          console.log(`Actor:          ${actor}`);
+          console.log(`Package:        ${pkg}`);
+          console.log(`Matched rule:   ${matchedRule.pattern} -> ${matchedRule.owners.join(', ')}`);
+          console.log(`Authorized:     ${authorized}`);
+
+          if (!authorized) {
+            console.error(`\nERROR: ${actor} is not a CODEOWNERS owner for ${pkg}`);
+            console.error(`Allowed users: ${matchedRule.owners.join(', ')}`);
+            process.exit(1);
+          }
+          SCRIPT
+
       - name: Install uv
         uses: astral-sh/setup-uv@v4
         with: