name: CLA Assistant

on:
  issue_comment:
    types: [created]
  pull_request_target:
    types: [opened, closed, synchronize]

permissions:
  actions: write
  # write (not read): CLA Assistant commits signatures/version1/cla.json to the
  # cla-signatures branch in this repo, so GITHUB_TOKEN needs contents:write.
  # With read-only it 403s ("Resource not accessible by integration") and the
  # signature is never recorded even after the contributor signs.
  contents: write
  pull-requests: write
  statuses: write

jobs:
  cla:
    runs-on: ubuntu-latest
    steps:
      - name: CLA Assistant
        if: (github.event.comment.body == 'recheck' || github.event.comment.body == 'I have read the CLA Document and I hereby sign the CLA') || github.event_name == 'pull_request_target'
        uses: contributor-assistant/github-action@v2.6.1
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          # PERSONAL_ACCESS_TOKEN is only required if signatures are stored in
          # a separate repository. For same-repo storage, GITHUB_TOKEN suffices.
        with:
          # Sentence the contributor posts as a PR comment to sign.
          custom-pr-sign-comment: "I have read the CLA Document and I hereby sign the CLA"
          custom-allsigned-prcomment: "All contributors have signed the CLA. Thank you!"
          # Where signatures are stored (a branch in this repo).
          path-to-signatures: "signatures/version1/cla.json"
          path-to-document: "https://github.com/rennf93/roboco/blob/master/CLA.md"
          branch: "cla-signatures"
          # Bots, the maintainer, and the org's own agent identities are
          # exempt from signing. Agent commits are authored as
          # "<Display Name> <slug@roboco.tech>" (workspace.py _configure_git);
          # the emails map to no GitHub account, so CLA Assistant identifies
          # them by display name — allowlist those names, wildcarded per team
          # family, mirroring roboco/seeds/initial_data.py's roster.
          #
          # roboco-app[bot] is the GitHub App the fleet pushes and opens PRs
          # under. It authors the sync/merge commits GitService creates when a
          # task branch is brought up to date with its base, so it is a
          # committer on essentially every fleet PR — and unlike the agent
          # identities it DOES map to a real GitHub account, so CLA Assistant
          # demands a signature it can never give: an App cannot post the
          # sign-off comment as itself. Exempting it is also correct on the
          # merits, since the CLA exists to obtain copyright assignment from
          # human contributors and the App commits on the copyright holder's
          # own behalf. Same form as dependabot[bot] above.
          allowlist: "dependabot[bot],roboco-app[bot],rennf93,Backend *,Frontend *,UX/UI *,Main PM,Product Owner,Head of Marketing,Auditor,Intake,Secretary,PR Reviewer,RoboCo Agent"