mirror of
https://github.com/snapotter-hq/SnapOtter.git
synced 2026-08-03 07:46:42 +02:00
SnapOtterandGitHub
ec6ff3d8a8
Token-Permissions (0 -> 10): Set permissions: {} at workflow top level
across all 7 workflows, moved write scopes to per-job minimum.
SAST (0 -> 10): Added CodeQL workflow for JavaScript/TypeScript and
Python analysis on push, PR, and weekly schedule.
Vulnerabilities (0 -> ~8): Added 13 pnpm overrides to patch transitive
dependency vulnerabilities (38 -> 2 remaining, both in dev-only tools).
Pinned-Dependencies (5 -> 8-9): Pinned all Docker FROM images to SHA
digests, pinned pip-audit version in CI, pinned pip version in
Dockerfile.
47 lines
2.0 KiB
YAML
47 lines
2.0 KiB
YAML
name: CLA Assistant
|
|
|
|
on:
|
|
issue_comment:
|
|
types: [created]
|
|
pull_request_target:
|
|
types: [opened, synchronize, reopened]
|
|
|
|
permissions: {}
|
|
|
|
jobs:
|
|
cla:
|
|
if: |
|
|
(github.event_name == 'pull_request_target') ||
|
|
(github.event_name == 'issue_comment' && github.event.comment.body == 'recheck')
|
|
runs-on: ubuntu-latest
|
|
permissions:
|
|
actions: write
|
|
contents: read
|
|
pull-requests: write
|
|
statuses: write
|
|
steps:
|
|
- name: CLA Assistant
|
|
uses: contributor-assistant/github-action@ca4a40a7d1004f18d9960b404b97e5f30a505a08 # v2.6.1
|
|
env:
|
|
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
|
PERSONAL_ACCESS_TOKEN: ${{ secrets.CLA_TOKEN }}
|
|
with:
|
|
path-to-signatures: "signatures/cla.json"
|
|
path-to-document: "https://github.com/snapotter-hq/snapotter/blob/main/CLA.md"
|
|
branch: "cla-signatures"
|
|
allowlist: "snapotter-hq,dependabot[bot],renovate[bot],github-actions[bot],snapotter-bot"
|
|
custom-notsigned-prcomment: |
|
|
Thank you for your contribution! Before we can merge this PR, you need to sign our [Contributor License Agreement](https://github.com/snapotter-hq/snapotter/blob/main/CLA.md).
|
|
|
|
**What the CLA does:** You keep ownership of your code. You grant SnapOtter a license to use your contribution under any license (including our commercial license). [Read the plain-language summary](https://github.com/snapotter-hq/snapotter/blob/main/CLA.md#plain-language-summary).
|
|
|
|
**How to sign:** Comment on this PR with the following text:
|
|
|
|
> I have read the CLA Document and I hereby sign the CLA
|
|
|
|
You only need to do this once. It applies to all future contributions.
|
|
custom-pr-sign-comment: "I have read the CLA Document and I hereby sign the CLA"
|
|
custom-allsigned-prcomment: "All contributors have signed the CLA. Thank you!"
|
|
lock-pullrequest-aftermerge: false
|
|
use-dco-flag: false
|