precommit/.github/workflows/cla.yml at main · Signetry/precommit · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
name: CLA

# Requires every contributor to sign the Contributor License Agreement (CLA.md)
# before their pull request can be merged. Runs entirely in this repo's Actions —
# no third-party OAuth app. Signatures are recorded in signatures/cla.json on this
# repo, so there is a durable, auditable record of each contributor's assent.
#
# This repo is Apache-2.0. The CLA is kept because Signetry is open core: code moves
# across the line between this Apache-2.0 integration surface and the BUSL-1.1 engine
# (Signetry/core, which converts to Apache-2.0 on 2030-08-31), and the CLA supplies the
# relicensing rights that makes possible. It does not reduce a contributor's own
# Apache-2.0 rights. See CONTRIBUTING.md.
#
# A contributor signs by commenting the exact statement below on their PR:
#   I have read the CLA Document and I hereby sign the CLA

on:
  issue_comment:
    types: [created]
  pull_request_target:
    types: [opened, synchronize, reopened]

permissions:
  actions: write
  contents: write        # write the signatures file
  pull-requests: write   # comment + label the PR
  statuses: write

jobs:
  cla:
    runs-on: ubuntu-latest
    # Skip the CLA gate for the Owner and bots (they are allowlisted). Skipping the
    # job makes the required check "cla" resolve as passed for these actors, so
    # their PRs never see a spurious CLA failure. Real contributors still run it.
    if: >-
      ${{
        !(
          github.event.pull_request.user.login == 'bkd-dotcom' ||
          github.event.pull_request.user.login == 'dependabot[bot]' ||
          github.event.issue.user.login == 'bkd-dotcom' ||
          github.event.issue.user.login == 'dependabot[bot]'
        )
      }}
    # Skip Dependabot / the Owner's own automated PRs if desired; contributors still gate.
    steps:
      - name: CLA Assistant
        if: (github.event.comment.body == 'recheck' || github.event.comment.body == 'I have read the CLA Document and I hereby sign the CLA') || github.event_name == 'pull_request_target'
        uses: contributor-assistant/github-action@v2.6.1
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        with:
          path-to-signatures: "signatures/cla.json"
          path-to-document: "https://github.com/Signetry/precommit/blob/main/CLA.md"
          branch: "cla-signatures"
          allowlist: "dependabot[bot],bkd-dotcom"
          custom-notsigned-prcomment: "Thanks for your contribution! Before it can be merged, please read the **[Contributor License Agreement](https://github.com/Signetry/precommit/blob/main/CLA.md)** — this repo is **Apache-2.0**, and the CLA lets us relicense contributions across Signetry's [open-core boundary](https://github.com/Signetry/signetry/blob/main/LICENSING.md) (for example moving an adapter into the BUSL-1.1 engine). You keep every Apache-2.0 right to this code, including the right to use your own contribution anywhere. To agree, reply with exactly:"
          custom-pr-sign-comment: "I have read the CLA Document and I hereby sign the CLA"
          custom-allsigned-prcomment: "All contributors have signed the CLA. ✅"
          lock-pullrequest-aftermerge: false