From 92a2bfcf6046e392fc3d1cae94a4f14bd2e37aef Mon Sep 17 00:00:00 2001
From: ajianaz <ajianaz@users.noreply.github.com>
Date: Fri, 11 Sep 2026 11:41:42 +0700
Subject: [PATCH 1/2] fix(ci): make cla-check work for fork PRs
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The CLA gate relied on a manually POSTed commit status. Fork PRs run
workflows with a read-only GITHUB_TOKEN regardless of declared
permissions, so the status step always 403s on forks — every external
fork PR was permanently red even with a signed CLA. The bot comment
step also 403s on forks.

- Drop the commit-status step and statuses:write; the gate now rides
  on this job's own Actions check run (fork-safe by construction).
- Comment step becomes same-repo-only + continue-on-error (courtesy,
  never a gate). Unsigned path emits a ::error annotation with the
  portal link instead.
- github-script upgraded to v9.

Validated end-to-end on codecoradev/uteke (PR #1224 + E2E probe).
---
 .github/workflows/cla-check.yml | 27 +++++----------------------
 1 file changed, 5 insertions(+), 22 deletions(-)

diff --git a/.github/workflows/cla-check.yml b/.github/workflows/cla-check.yml
index 4bdc0ab..cdda26d 100644
--- a/.github/workflows/cla-check.yml
+++ b/.github/workflows/cla-check.yml
@@ -7,11 +7,11 @@ on:
 permissions:
   pull-requests: write
   contents: read
-  statuses: write
 
 jobs:
   cla-check:
     runs-on: ubuntu-latest
+    if: "!contains(fromJSON([\"dependabot[bot]\", \"renovate[bot]\", \"github-actions[bot]\", \"app/dependabot\", \"app/renovate\"]'), github.event.pull_request.user.login)"
     steps:
       - name: Fetch & check CLA signature
         id: check
@@ -45,8 +45,9 @@ jobs:
         env:
           PR_AUTHOR: ${{ github.event.pull_request.user.login }}
 
-      - name: Comment on PR (unsigned only)
-        if: steps.check.outputs.signed != 'true'
+      - name: Comment on PR (same-repo, best effort)
+        if: steps.check.outputs.signed != 'true' && github.event.pull_request.head.repo.full_name == github.repository
+        continue-on-error: true
         uses: actions/github-script@v9
         with:
           script: |
@@ -95,27 +96,9 @@ jobs:
               });
             }
 
-      - name: Set commit status
-        uses: actions/github-script@v9
-        with:
-          script: |
-            const signed = '${{ steps.check.outputs.signed }}' === 'true';
-            await github.rest.repos.createCommitStatus({
-              owner: context.repo.owner,
-              repo: context.repo.repo,
-              sha: '${{ github.event.pull_request.head.sha }}',
-              state: signed ? 'success' : 'failure',
-              context: 'CLA Check',
-              description: signed
-                ? '✅ CLA signed'
-                : '❌ CLA not signed — sign at https://codecoradev.github.io/cla',
-              target_url: signed
-                ? 'https://github.com/codecoradev/.github/blob/main/.cla/signatures.json'
-                : 'https://codecoradev.github.io/cla',
-            });
-
       - name: Fail if not signed
         if: steps.check.outputs.signed != 'true'
         run: |
+          echo "::error title=CLA not signed::Sign the CodeCoraDev CLA at https://codecoradev.github.io/cla — once the signature PR is merged, this check turns green automatically (re-run it or wait ~1 hour)."
           echo "❌ CLA not signed by ${{ github.event.pull_request.user.login }}"
           exit 1

From 0b6c1ef5c6580e1a54e53736691a847aadeb7e12 Mon Sep 17 00:00:00 2001
From: ajianaz <ajianaz@users.noreply.github.com>
Date: Fri, 11 Sep 2026 12:09:24 +0700
Subject: [PATCH 2/2] fix(ci): repair job-level bot-exclusion expression
 quoting

The if-expression was missing the opening quote before the JSON array
inside fromJSON(), which makes the whole workflow unparseable for
GitHub Actions. Line now matches the validated uteke@develop file
verbatim.
---
 .github/workflows/cla-check.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/cla-check.yml b/.github/workflows/cla-check.yml
index cdda26d..1bf610f 100644
--- a/.github/workflows/cla-check.yml
+++ b/.github/workflows/cla-check.yml
@@ -11,7 +11,7 @@ permissions:
 jobs:
   cla-check:
     runs-on: ubuntu-latest
-    if: "!contains(fromJSON([\"dependabot[bot]\", \"renovate[bot]\", \"github-actions[bot]\", \"app/dependabot\", \"app/renovate\"]'), github.event.pull_request.user.login)"
+    if: "!contains(fromJSON('[\"dependabot[bot]\", \"renovate[bot]\", \"github-actions[bot]\", \"app/dependabot\", \"app/renovate\"]'), github.event.pull_request.user.login)"
     steps:
       - name: Fetch & check CLA signature
         id: check