-
Notifications
You must be signed in to change notification settings - Fork 310
chore: First steps toward CLA signing #2830
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Changes from 1 commit
File filter
Filter by extension
Conversations
Jump to
Diff view
Diff view
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change | ||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| @@ -0,0 +1,29 @@ | ||||||||||||||||
| name: "CLA Assistant" | ||||||||||||||||
| on: | ||||||||||||||||
| issue_comment: | ||||||||||||||||
| types: [created] | ||||||||||||||||
| pull_request_target: | ||||||||||||||||
| types: [opened,closed,synchronize] | ||||||||||||||||
|
|
||||||||||||||||
| # explicitly configure permissions, in case your GITHUB_TOKEN workflow permissions are set to read-only in repository settings | ||||||||||||||||
| permissions: | ||||||||||||||||
| actions: write | ||||||||||||||||
| contents: write # this can be 'read' if the signatures are in remote repository | ||||||||||||||||
| pull-requests: write | ||||||||||||||||
| statuses: write | ||||||||||||||||
|
Comment on lines
+9
to
+13
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Reduce workflow token permissions to least privilege.
🔐 Suggested patch permissions:
- actions: write
contents: write # this can be 'read' if the signatures are in remote repository
pull-requests: write
statuses: write🤖 Prompt for AI Agents |
||||||||||||||||
|
|
||||||||||||||||
| jobs: | ||||||||||||||||
| CLAAssistant: | ||||||||||||||||
| runs-on: ubuntu-latest | ||||||||||||||||
| steps: | ||||||||||||||||
| - name: "CLA Assistant" | ||||||||||||||||
| if: (github.event.comment.body == 'recheck' || github.event.comment.body == 'I have read the CLA Document and I hereby sign the CLA') || github.event_name == 'pull_request_target' | ||||||||||||||||
|
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Gate At Line 20, the condition can run on regular issue comments if body matches. Add a PR check to avoid unnecessary privileged runs. 🧩 Suggested patch- if: (github.event.comment.body == 'recheck' || github.event.comment.body == 'I have read the CLA Document and I hereby sign the CLA') || github.event_name == 'pull_request_target'
+ if: >
+ (github.event_name == 'issue_comment' &&
+ github.event.issue.pull_request &&
+ (github.event.comment.body == 'recheck' ||
+ github.event.comment.body == 'I have read the CLA Document and I hereby sign the CLA'))
+ || github.event_name == 'pull_request_target'📝 Committable suggestion
Suggested change
🤖 Prompt for AI Agents |
||||||||||||||||
| uses: contributor-assistant/github-action@v2.6.1 | ||||||||||||||||
|
coderabbitai[bot] marked this conversation as resolved.
Outdated
brob marked this conversation as resolved.
Outdated
|
||||||||||||||||
| env: | ||||||||||||||||
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | ||||||||||||||||
| with: | ||||||||||||||||
| path-to-signatures: 'signatures/version1/cla.json' | ||||||||||||||||
| path-to-document: 'https://raw.githubusercontent.com/Permify/permify/refs/heads/master/CLA.md' # e.g. a CLA or a DCO document | ||||||||||||||||
| # branch should not be protected | ||||||||||||||||
| branch: 'main' | ||||||||||||||||
|
coderabbitai[bot] marked this conversation as resolved.
Outdated
brob marked this conversation as resolved.
Outdated
|
||||||||||||||||
| allowlist: user1,bot* | ||||||||||||||||
|
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
# Verify that contributor-assistant/github-action supports the glob pattern syntax for allowlist
# Check the action's README or documentation for allowlist format
gh api repos/contributor-assistant/github-action/contents/README.md --jq '.content' | base64 -d | grep -A 20 -i "allowlist"Repository: Permify/permify Length of output: 111 🏁 Script executed: cat .github/workflows/cla.ymlRepository: Permify/permify Length of output: 1213 🏁 Script executed: ls -la .github/ | grep -E "(dependabot|cla)"Repository: Permify/permify Length of output: 122 🏁 Script executed: cat -n .github/dependabot.yml 2>/dev/null || echo "dependabot.yml not found"Repository: Permify/permify Length of output: 1325 🏁 Script executed: # Search for any documentation or comments about CLA action in the repository
rg "contributor-assistant" --type yml -A 5 -B 5Repository: Permify/permify Length of output: 86 🏁 Script executed: # Search for any comments or documentation in the repository about the CLA action
rg "contributor-assistant" -A 10 -B 5 --type yamlRepository: Permify/permify Length of output: 41 🏁 Script executed: # Look for any issue discussions or documentation files mentioning CLA or allowlist
find . -type f \( -name "*.md" -o -name "*.txt" \) | head -20 | xargs rg -l "allowlist|CLA|contributor-assistant" 2>/dev/null || echo "No matches found"Repository: Permify/permify Length of output: 85 🌐 Web query:
💡 Result: The contributor-assistant/github-action (CLA Assistant Lite) uses an allowlist input to specify GitHub users or bots exempt from signing the CLA. The syntax is a comma-separated string of usernames or patterns. Examples from official documentation: - Specific users and bots: user1,user2,dependabot[bot],greenkeeper[bot] - Wildcard for all bots: bot* Usage in workflow YAML: uses: contributor-assistant/github-action@v2.6.1 with: allowlist: user1,bot* This skips CLA checks for matching users/bots. Default is empty string (no exemptions). Wildcards like * match username suffixes/prefixes, e.g., bot* for any username starting with "bot". Citations:
Fix allowlist pattern to exempt Dependabot from CLA checks. The current allowlist
Since Dependabot is actively configured across multiple ecosystems in Suggested fix- allowlist: user1,bot*
+ allowlist: dependabot[bot],bot*Or to cover more bot patterns: - allowlist: user1,bot*
+ allowlist: dependabot[bot],*[bot]🤖 Prompt for AI Agents |
||||||||||||||||
| Original file line number | Diff line number | Diff line change | ||||
|---|---|---|---|---|---|---|
| @@ -0,0 +1,31 @@ | ||||||
| **INVERSOFT, LLC CONTRIBUTION LICENSE AGREEMENT** | ||||||
|
|
||||||
| This Contribution License Agreement (the “**CLA**”) is between the individual set forth in the signature block (“**You**”) and Inversoft, LLC., dba FusionAuth and Permify (the “**Company**”), effective as of the date of Your signature and sets forth the terms pursuant to which You provides Contributions to the Company. | ||||||
|
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Fix grammatical error in the opening clause. At Line 3, ✏️ Suggested patch-This Contribution License Agreement (the “**CLA**”) is between the individual set forth in the signature block (“**You**”) and Inversoft, LLC., dba FusionAuth and Permify (the “**Company**”), effective as of the date of Your signature and sets forth the terms pursuant to which You provides Contributions to the Company.
+This Contribution License Agreement (the “**CLA**”) is between the individual set forth in the signature block (“**You**”) and Inversoft, LLC., dba FusionAuth and Permify (the “**Company**”), effective as of the date of Your signature and sets forth the terms pursuant to which You provide Contributions to the Company. 📝 Committable suggestion
Suggested change
🤖 Prompt for AI Agents |
||||||
|
|
||||||
| You accept and agree to the following terms and conditions for Your present and future Contributions submitted to the Company. In return, the Company will not use Your Contributions in a way that is contrary to the Company’s business objectives. Except for the license granted herein to the Company and recipients of software distributed by the Company, You reserve all right, title, and interest in and to Your Contributions. | ||||||
|
|
||||||
| 1. Definitions. “**Contribution**” means any original work of authorship, including any modifications or additions to an existing work, that You intentionally submit to the Company for inclusion in, or documentation of, any of the products owned or managed by the Company (the “**Work**”). “**Submit**” means any form of electronic, verbal, or written communication sent to the Company or its representatives, including but not limited to communication on electronic mailing lists, source code control systems, and issue tracking systems that are managed by, or on behalf of, the Company for the purpose of discussing and improving the Work, but excluding communication that is conspicuously marked or otherwise designated in writing by You as “Not a Contribution.” | ||||||
|
|
||||||
| 2. Copyright License. Subject to the terms and conditions of this CLA, You hereby grant to the Company and to recipients of software distributed by the Company a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Your Contributions and such derivative works. | ||||||
|
|
||||||
| 3. Patent License. Subject to the terms and conditions of this CLA, You hereby grant to the Company and to recipients of software distributed by the Company a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable (except as stated in this section) patent license to make, have made, use, offer to sell, sell, import, and otherwise transfer the Work, where such license applies only to those patent claims licensable by You that are necessarily infringed by Your Contribution(s) alone or by combination of Your Contribution(s) with the Work to which such Contribution(s) was submitted. If any entity institutes patent litigation against You or any other entity (including a cross-claim or counterclaim in a lawsuit) alleging that Your Contribution, or the Work to which You have contributed, constitutes direct or contributory patent infringement, then any patent licenses granted to that entity under this CLA for that Contribution or Work will terminate as of the date such litigation is filed. | ||||||
|
|
||||||
| 4. Representations and Warranties. You represent and warrant to the Company that: | ||||||
|
|
||||||
| 1. You are legally entitled to grant the above license, and if Your employer(s) has rights to intellectual property that You create that includes Your Contributions, then You represent and warrant that You have received permission to make Contributions on behalf of that employer, that Your employer has waived such rights for Your Contributions to the Company, or that Your employer has executed a separate CLA with the Company; | ||||||
|
|
||||||
| 2. Each of Your Contributions is Your original creation (see section 6 for submissions on behalf of others); and | ||||||
|
|
||||||
|
Contributor
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. weird spacing.
Contributor
Author
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Are you referring to the indentations on this? |
||||||
|
|
||||||
|
|
||||||
| 3. Your Contribution submissions include complete details of any third-party license or other restriction (including, but not limited to, related patents and trademarks) of which You are personally aware and which are associated with any part of Your Contributions. | ||||||
|
|
||||||
|
|
||||||
|
brob marked this conversation as resolved.
|
||||||
|
|
||||||
| 5. Support; Disclaimer. You are not expected to provide support for Your Contributions, except to the extent You desire to do so. You may provide support for free, for a fee, or not at all. Unless required by applicable law or agreed to in writing, You provide Your Contributions on an “AS IS” BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied, including, without limitation, any warranties or conditions of TITLE, NON- INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A PARTICULAR PURPOSE. | ||||||
|
|
||||||
| 6. Third Party Works. If You wish to submit work that is not Your original creation, then You may submit it to the Company separately from any Contribution, identifying the complete details of its source and of any license or other restriction (including, but not limited to, related patents, trademarks, and license agreements) of which You are personally aware, and conspicuously marking the work as “Submitted on behalf of a third-party: \[named here\]”. | ||||||
|
|
||||||
| 7. You agree to notify the Company of any facts or circumstances of which You become aware that would make Your representations in this CLA inaccurate in any respect. | ||||||
|
|
||||||
| 8. General. This CLA is the entire understanding and agreement with respect to the subject matter hereof, and supersedes any and all prior or contemporaneous representations, understandings, and agreements, between the parties regarding same. If any part of this CLA is found to be unenforceable, the remaining portions of this CLA will remain in full force and effect. No modification of or amendment to this CLA, nor any waiver of any rights under this CLA, will be effective unless in writing signed by the party to be charged, and the waiver of any breach or default will not constitute a waiver of any other right under this CLA or any subsequent breach or default. Nothing in this CLA creates and the parties do not intend to create, any partnership or joint venture between themselves. Either party may freely assign this CLA. This CLA is binding upon and will inure to the benefit of a party’s successors and permitted assigns. This CLA will be governed by the laws of the State of New York. Exclusive jurisdiction of any and all disputes hereunder will be in the state and federal courts in New York, New York. This CLA may be executed in counterparts with the same effect as if all signatories had signed the same document. | ||||||
|
brob marked this conversation as resolved.
|
||||||
Uh oh!
There was an error while loading. Please reload this page.