mirror of
https://github.com/rennf93/roboco.git
synced 2026-08-03 07:23:24 +02:00
0fe21b1f97
The App the fleet pushes and opens PRs under authors the sync/merge commits GitService creates when a task branch is brought up to date with its base, so it is a committer on essentially every fleet PR. Unlike the agent identities — whose roboco.tech emails map to no GitHub account, so CLA Assistant matches them by the display names already allowlisted — the App maps to a real account, and CLA Assistant demands a signature it cannot give: an App cannot post the sign-off comment as itself. The result is a permanently red `cla` check on fleet PRs (currently #703 and #704) that no amount of rework can clear, which sends the PR reviewer round another revision loop with nothing to fix. Exempting it is also correct on the merits: the CLA exists to obtain copyright assignment from human contributors, and the App commits on the copyright holder's own behalf. Same form as the dependabot[bot] entry. Co-authored-by: Renn F <rennf93@users.noreply.github.com>
56 lines
2.9 KiB
YAML
56 lines
2.9 KiB
YAML
name: CLA Assistant
|
|
|
|
on:
|
|
issue_comment:
|
|
types: [created]
|
|
pull_request_target:
|
|
types: [opened, closed, synchronize]
|
|
|
|
permissions:
|
|
actions: write
|
|
# write (not read): CLA Assistant commits signatures/version1/cla.json to the
|
|
# cla-signatures branch in this repo, so GITHUB_TOKEN needs contents:write.
|
|
# With read-only it 403s ("Resource not accessible by integration") and the
|
|
# signature is never recorded even after the contributor signs.
|
|
contents: write
|
|
pull-requests: write
|
|
statuses: write
|
|
|
|
jobs:
|
|
cla:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- name: CLA Assistant
|
|
if: (github.event.comment.body == 'recheck' || github.event.comment.body == 'I have read the CLA Document and I hereby sign the CLA') || github.event_name == 'pull_request_target'
|
|
uses: contributor-assistant/github-action@v2.6.1
|
|
env:
|
|
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
|
# PERSONAL_ACCESS_TOKEN is only required if signatures are stored in
|
|
# a separate repository. For same-repo storage, GITHUB_TOKEN suffices.
|
|
with:
|
|
# Sentence the contributor posts as a PR comment to sign.
|
|
custom-pr-sign-comment: "I have read the CLA Document and I hereby sign the CLA"
|
|
custom-allsigned-prcomment: "All contributors have signed the CLA. Thank you!"
|
|
# Where signatures are stored (a branch in this repo).
|
|
path-to-signatures: "signatures/version1/cla.json"
|
|
path-to-document: "https://github.com/rennf93/roboco/blob/master/CLA.md"
|
|
branch: "cla-signatures"
|
|
# Bots, the maintainer, and the org's own agent identities are
|
|
# exempt from signing. Agent commits are authored as
|
|
# "<Display Name> <slug@roboco.tech>" (workspace.py _configure_git);
|
|
# the emails map to no GitHub account, so CLA Assistant identifies
|
|
# them by display name — allowlist those names, wildcarded per team
|
|
# family, mirroring roboco/seeds/initial_data.py's roster.
|
|
#
|
|
# roboco-app[bot] is the GitHub App the fleet pushes and opens PRs
|
|
# under. It authors the sync/merge commits GitService creates when a
|
|
# task branch is brought up to date with its base, so it is a
|
|
# committer on essentially every fleet PR — and unlike the agent
|
|
# identities it DOES map to a real GitHub account, so CLA Assistant
|
|
# demands a signature it can never give: an App cannot post the
|
|
# sign-off comment as itself. Exempting it is also correct on the
|
|
# merits, since the CLA exists to obtain copyright assignment from
|
|
# human contributors and the App commits on the copyright holder's
|
|
# own behalf. Same form as dependabot[bot] above.
|
|
allowlist: "dependabot[bot],roboco-app[bot],rennf93,Backend *,Frontend *,UX/UI *,Main PM,Product Owner,Head of Marketing,Auditor,Intake,Secretary,PR Reviewer,RoboCo Agent"
|