Repository navigation
ci(cla): add the CLA bot from VoiceStudio - #133
Merged
Merged
Conversation
Port VoiceStudio's comment-signed CLA check. Every pull request's opener and commit authors and co-authors sign CLA.md once by comment; signatures are stored on the cla-signatures branch and the check sets a CLA commit status, the cla-signed label and a summary comment. The privileged workflows check out only the base branch's .github/scripts, never pull-request code. Adds the daily reminder job, a manual backfill that runs the check on every open pull request, the sign phrase in CLA.md and CONTRIBUTING.md, and a CI job for the checker's tests. Signed-off-by: Shimul Debnath <270455167+velixio@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Adds the CLA bot used in VoiceStudio. Contributors sign CLA.md once by posting this comment on their pull request:
CLAcheck (cla.yml,pull_request_target+issue_comment): checks the PR opener and every commit author and co-author by GitHub account ID. It records signatures on acla-signaturesbranch, which it creates on first use. It sets aCLAcommit status and keeps thecla-signedlabel and one summary comment up to date. Maintainers can applycla-overrideafter reviewing a PR by hand. Commentingrecheckreruns the check.cla-reminders.yml): a daily job that nudges unsigned PRs and labels themawaiting-cla/cla-wait-expired.cla-backfill.yml): started by hand, it runs the check on every open PR. Run it once after merging to tag the existing PRs.Changes from VoiceStudio:
CLA.md.CLA-CORPORATE.md.tests/test_cla_security.pyreplaces them.Security
pull_request_targetandissue_commentrun with a write token even for fork PRs. All three workflows check out only the base branch's.github/scripts(sparse checkout,persist-credentials: false) and never run pull-request code.tests/test_cla_security.pyenforces this, and also checks that no step puts event text directly into a shell script.Validation
uv run --no-project --with pytest==8.4.2 --with pyyaml==6.0.3 python -m pytest tests -q: 114 passed. A newCLA bot testsCI job runs the same command.After merge
mainto check and tag every open PR.CLAa required status check onmain.