TheZwiss
747f1b9c5c
The CLA Assistant appends each signature as a direct commit to the branch named in 'branch:'. That was main, which the 'Require CI on main' ruleset rejects ('Repository rule violations found'), so signatures were never recorded and the check stayed red however often a contributor signed — a deadlock for every outside contribution.
Point the store at the cla-signatures branch. The ruleset targets the default branch only, so the bot can append there without granting any actor a bypass on main. That branch is seeded with the existing signature and carries its own ruleset blocking deletion and non-fast-forward pushes.
60 lines
2.8 KiB
YAML
60 lines
2.8 KiB
YAML
name: CLA Assistant
|
|
|
|
# Requires every contributor to sign the project Contributor License Agreement
|
|
# (CLA.md) before their pull request can be merged. Signatures are stored in
|
|
# this repository at signatures/cla.json on the `cla-signatures` branch — no
|
|
# external service or database is used. A contributor signs by commenting the
|
|
# exact sentence configured below.
|
|
#
|
|
# Why not `main`: the action appends each signature as a direct commit, which
|
|
# the "Require CI on main" ruleset rejects ("Repository rule violations found"),
|
|
# leaving the signature unrecorded and the check permanently red. Keeping the
|
|
# store on its own branch lets the bot append without granting any actor a
|
|
# bypass on main. That branch has its own ruleset blocking deletion and
|
|
# force-pushes, so the record cannot be rewritten.
|
|
|
|
on:
|
|
issue_comment:
|
|
types: [created]
|
|
pull_request_target:
|
|
types: [opened, closed, synchronize]
|
|
|
|
# `contents: write` lets the action commit the signatures file back to the repo.
|
|
permissions:
|
|
actions: write
|
|
contents: write
|
|
pull-requests: write
|
|
statuses: write
|
|
|
|
jobs:
|
|
cla-assistant:
|
|
runs-on: ubuntu-latest
|
|
# Skip CLA enforcement on bot-authored PRs (e.g. Dependabot) and on the
|
|
# maintainer's own PRs via the allowlist below.
|
|
steps:
|
|
- name: CLA Assistant
|
|
if: |
|
|
(github.event.comment.body == 'recheck' ||
|
|
github.event.comment.body == 'I have read the CLA Document and I hereby sign the CLA') ||
|
|
github.event_name == 'pull_request_target'
|
|
uses: contributor-assistant/github-action@ca4a40a7d1004f18d9960b404b97e5f30a505a08 # v2.6.1
|
|
env:
|
|
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
|
with:
|
|
# Where signatures are recorded (committed to this repo on `branch`).
|
|
path-to-signatures: 'signatures/cla.json'
|
|
# The CLA document contributors are agreeing to.
|
|
path-to-document: 'https://github.com/TheZwiss/backspace/blob/main/CLA.md'
|
|
branch: 'cla-signatures'
|
|
# Accounts that never need to sign (maintainer + automation).
|
|
allowlist: 'TheZwiss,dependabot[bot],github-actions[bot]'
|
|
# The exact phrase a contributor comments to sign.
|
|
custom-allsigned-prcomment: 'All contributors have signed the CLA. Thank you!'
|
|
custom-pr-sign-comment: 'I have read the CLA Document and I hereby sign the CLA'
|
|
custom-notsigned-prcomment: >
|
|
Thank you for your contribution! Before we can merge it, we need you
|
|
to sign our [Contributor License Agreement](https://github.com/TheZwiss/backspace/blob/main/CLA.md).
|
|
You keep the copyright to your work — this just grants the maintainer
|
|
the rights needed to use and relicense the project. To sign, post a
|
|
comment below with **exactly** this sentence:
|