Repository navigation
CLA: save signatures on CLA's signatures branch; exemption that can't be claimed by email (1.3.0) - #18
Merged
Conversation
… be claimed by email (1.3.0) - branch: "signatures", the bot-only branch in CLA (main refuses the bot's push since 10-27) - the job runs, and mints the App token, only for pull request events or a pull request comment that is "recheck" or contains the sign phrase - members and named bots are exempt only when the pull request's opener is one of them; otherwise only a member's signed commits, committed by that member, are exempt - a pull request with more than 100 commits fails: the action reads only the first 100 - the ICLA link points at a fixed commit
On such a pull request the opener and every commit author must sign, members and bots included; the signed-commit exemption is gone, so commit signatures play no part. An outside opener with no commit in the pull request fails the check, since the action records only commit authors.
Open
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
CLA signatures have not saved since 10-27: the action pushes to CLA
main, which now requires a reviewed pull request. This moves them to a new bot-only branch and tightens who is exempt.branch: "signatures". The branch in CLA holds onlysignatures/version1/cla.json; rulesets block deletion and force-push for everyone and updates for everyone but bls-cla-bot.main's copy stays as a frozen archive.recheckor contains the sign phrase. Other comments no longer mint a token.Effect on maintainers: a member who adds a commit to an outside contributor's pull request (including GitHub's "Update branch") signs the CLA, once.
Callers move to this version by repinning (
cla-reusable.yml@<sha of v1.3.0>); nothing changes until they do. Minor version: same inputs and secrets.Tests:
tests/test_cla_check.pyruns the exemption step against a stubgh(14 cases, one per rule above plus a claimed bot email, a commit without a login, a failed lookup, over 100 commits and an outside opener without a commit). 60 pass; making members exempt on an outside contributor's pull request fails 3 cases, and dropping the opener check fails 1.actionlint1.7.12 with shellcheck andzizmor1.30.1 (online audits) report nothing.