Public-release prep: ELv2 license, README/CLA/NOTICE, SSRF safeFetch, identifier genericization, export tooling

2026-06-22 16:04:03 +02:00
parent c0a6477059
commit 8dd76f3435
44 changed files with 1272 additions and 267 deletions
@@ -0,0 +1,51 @@
+name: CLA Assistant
+
+# Requires every contributor to sign the project Contributor License Agreement
+# (CLA.md) before their pull request can be merged. Signatures are stored in
+# this repository at signatures/cla.json — no external service or database is
+# used. A contributor signs by commenting the exact sentence configured below.
+
+on:
+  issue_comment:
+    types: [created]
+  pull_request_target:
+    types: [opened, closed, synchronize]
+
+# `contents: write` lets the action commit the signatures file back to the repo.
+permissions:
+  actions: write
+  contents: write
+  pull-requests: write
+  statuses: write
+
+jobs:
+  cla-assistant:
+    runs-on: ubuntu-latest
+    # Skip CLA enforcement on bot-authored PRs (e.g. Dependabot) and on the
+    # maintainer's own PRs via the allowlist below.
+    steps:
+      - name: CLA Assistant
+        if: |
+          (github.event.comment.body == 'recheck' ||
+           github.event.comment.body == 'I have read the CLA Document and I hereby sign the CLA') ||
+          github.event_name == 'pull_request_target'
+        uses: contributor-assistant/github-action@v2.6.1
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        with:
+          # Where signatures are recorded (committed to this repo on `branch`).
+          path-to-signatures: 'signatures/cla.json'
+          # The CLA document contributors are agreeing to.
+          path-to-document: 'https://github.com/TheZwiss/backspace/blob/main/CLA.md'
+          branch: 'main'
+          # Accounts that never need to sign (maintainer + automation).
+          allowlist: 'TheZwiss,dependabot[bot],github-actions[bot]'
+          # The exact phrase a contributor comments to sign.
+          custom-allsigned-prcomment: 'All contributors have signed the CLA. Thank you!'
+          custom-pr-sign-comment: 'I have read the CLA Document and I hereby sign the CLA'
+          custom-notsigned-prcomment: >
+            Thank you for your contribution! Before we can merge it, we need you
+            to sign our [Contributor License Agreement](https://github.com/TheZwiss/backspace/blob/main/CLA.md).
+            You keep the copyright to your work — this just grants the maintainer
+            the rights needed to use and relicense the project. To sign, post a
+            comment below with **exactly** this sentence: