Skip to content
Merged
Show file tree
Hide file tree
Changes from 1 commit
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
29 changes: 29 additions & 0 deletions .github/workflows/cla.yml
Original file line number Diff line number Diff line change
@@ -0,0 +1,29 @@
name: "CLA Assistant"
on:
issue_comment:
types: [created]
Comment thread
brob marked this conversation as resolved.
pull_request_target:
types: [opened,closed,synchronize]

# explicitly configure permissions, in case your GITHUB_TOKEN workflow permissions are set to read-only in repository settings
permissions:
actions: write
contents: write # this can be 'read' if the signatures are in remote repository
pull-requests: write
statuses: write
Comment on lines +9 to +13
Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major

Reduce workflow token permissions to least privilege.

actions: write is broader than needed for this job and should be removed unless there is a demonstrated requirement.

🔐 Suggested patch
 permissions:
-  actions: write
   contents: write # this can be 'read' if the signatures are in remote repository
   pull-requests: write
   statuses: write
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.

In @.github/workflows/cla.yml around lines 9 - 13, The workflow currently grants
overly broad permissions by setting "actions: write"; remove the "actions:
write" entry (or change it to "actions: read" only if needed) within the
permissions block so the workflow token has least privilege; ensure the
remaining keys ("contents", "pull-requests", "statuses") retain their intended
values and verify no code in this workflow requires action-level write access
before committing the change.


jobs:
CLAAssistant:
runs-on: ubuntu-latest
steps:
- name: "CLA Assistant"
if: (github.event.comment.body == 'recheck' || github.event.comment.body == 'I have read the CLA Document and I hereby sign the CLA') || github.event_name == 'pull_request_target'
Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟡 Minor

Gate issue_comment execution to pull requests only.

At Line 20, the condition can run on regular issue comments if body matches. Add a PR check to avoid unnecessary privileged runs.

🧩 Suggested patch
-        if: (github.event.comment.body == 'recheck' || github.event.comment.body == 'I have read the CLA Document and I hereby sign the CLA') || github.event_name == 'pull_request_target'
+        if: >
+          (github.event_name == 'issue_comment' &&
+           github.event.issue.pull_request &&
+           (github.event.comment.body == 'recheck' ||
+            github.event.comment.body == 'I have read the CLA Document and I hereby sign the CLA'))
+          || github.event_name == 'pull_request_target'
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
if: (github.event.comment.body == 'recheck' || github.event.comment.body == 'I have read the CLA Document and I hereby sign the CLA') || github.event_name == 'pull_request_target'
if: >
(github.event_name == 'issue_comment' &&
github.event.issue.pull_request &&
(github.event.comment.body == 'recheck' ||
github.event.comment.body == 'I have read the CLA Document and I hereby sign the CLA'))
|| github.event_name == 'pull_request_target'
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.

In @.github/workflows/cla.yml at line 20, The workflow condition currently
allows issue comments to trigger the job whenever comment body matches; update
the if expression to ensure issue_comment events are from pull requests by
requiring github.event_name == 'issue_comment' &&
github.event.issue.pull_request != null (or truthy) before evaluating
github.event.comment.body, e.g. change the left side to (github.event_name ==
'issue_comment' && github.event.issue.pull_request != null &&
(github.event.comment.body == 'recheck' || github.event.comment.body == 'I have
read the CLA Document and I hereby sign the CLA')) || github.event_name ==
'pull_request_target' so only PR comments trigger the job while preserving
pull_request_target behavior.

uses: contributor-assistant/github-action@v2.6.1
Comment thread
coderabbitai[bot] marked this conversation as resolved.
Outdated
Comment thread
brob marked this conversation as resolved.
Outdated
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
with:
path-to-signatures: 'signatures/version1/cla.json'
path-to-document: 'https://raw.githubusercontent.com/Permify/permify/refs/heads/master/CLA.md' # e.g. a CLA or a DCO document
# branch should not be protected
branch: 'main'
Comment thread
coderabbitai[bot] marked this conversation as resolved.
Outdated
Comment thread
brob marked this conversation as resolved.
Outdated
allowlist: user1,bot*
Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
# Verify that contributor-assistant/github-action supports the glob pattern syntax for allowlist

# Check the action's README or documentation for allowlist format
gh api repos/contributor-assistant/github-action/contents/README.md --jq '.content' | base64 -d | grep -A 20 -i "allowlist"

Repository: Permify/permify

Length of output: 111


🏁 Script executed:

cat .github/workflows/cla.yml

Repository: Permify/permify

Length of output: 1213


🏁 Script executed:

ls -la .github/ | grep -E "(dependabot|cla)"

Repository: Permify/permify

Length of output: 122


🏁 Script executed:

cat -n .github/dependabot.yml 2>/dev/null || echo "dependabot.yml not found"

Repository: Permify/permify

Length of output: 1325


🏁 Script executed:

# Search for any documentation or comments about CLA action in the repository
rg "contributor-assistant" --type yml -A 5 -B 5

Repository: Permify/permify

Length of output: 86


🏁 Script executed:

# Search for any comments or documentation in the repository about the CLA action
rg "contributor-assistant" -A 10 -B 5 --type yaml

Repository: Permify/permify

Length of output: 41


🏁 Script executed:

# Look for any issue discussions or documentation files mentioning CLA or allowlist
find . -type f \( -name "*.md" -o -name "*.txt" \) | head -20 | xargs rg -l "allowlist|CLA|contributor-assistant" 2>/dev/null || echo "No matches found"

Repository: Permify/permify

Length of output: 85


🌐 Web query:

contributor-assistant/github-action allowlist pattern syntax documentation

💡 Result:

The contributor-assistant/github-action (CLA Assistant Lite) uses an allowlist input to specify GitHub users or bots exempt from signing the CLA. The syntax is a comma-separated string of usernames or patterns. Examples from official documentation: - Specific users and bots: user1,user2,dependabot[bot],greenkeeper[bot] - Wildcard for all bots: bot* Usage in workflow YAML: uses: contributor-assistant/github-action@v2.6.1 with: allowlist: user1,bot* This skips CLA checks for matching users/bots. Default is empty string (no exemptions). Wildcards like * match username suffixes/prefixes, e.g., bot* for any username starting with "bot".

Citations:


Fix allowlist pattern to exempt Dependabot from CLA checks.

The current allowlist user1,bot* has two issues:

  1. Placeholder value: user1 appears to be example text that should be removed or replaced with actual GitHub usernames.
  2. Dependabot won't be exempted: The pattern bot* matches usernames starting with "bot", but Dependabot's account is dependabot[bot], which starts with "dependabot" and won't match. This will cause CLA checks to fail on automated dependency update PRs.

Since Dependabot is actively configured across multiple ecosystems in dependabot.yml, it should be explicitly exempted.

Suggested fix
-          allowlist: user1,bot*
+          allowlist: dependabot[bot],bot*

Or to cover more bot patterns:

-          allowlist: user1,bot*
+          allowlist: dependabot[bot],*[bot]
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.

In @.github/workflows/cla.yml at line 29, Update the allowlist entry so it no
longer contains the placeholder "user1" and explicitly exempts Dependabot;
locate the allowlist key (allowlist: user1,bot*) and replace the value to remove
the placeholder and include Dependabot (e.g. use dependabot[bot] or a broader
dependabot* pattern) and optionally retain other bot patterns as needed so
Dependabot PRs are exempt from CLA checks.

31 changes: 31 additions & 0 deletions CLA.md
Original file line number Diff line number Diff line change
@@ -0,0 +1,31 @@
**INVERSOFT, LLC CONTRIBUTION LICENSE AGREEMENT**

This Contribution License Agreement (the “**CLA**”) is between the individual set forth in the signature block (“**You**”) and Inversoft, LLC., dba FusionAuth and Permify (the “**Company**”), effective as of the date of Your signature and sets forth the terms pursuant to which You provides Contributions to the Company.
Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟡 Minor

Fix grammatical error in the opening clause.

At Line 3, You provides Contributions should be You provide Contributions to avoid ambiguity in legal wording.

✏️ Suggested patch
-This Contribution License Agreement (the “**CLA**”) is between the individual set forth in the signature block (“**You**”) and Inversoft, LLC., dba FusionAuth and Permify (the “**Company**”), effective as of the date of Your signature and sets forth the terms pursuant to which You provides Contributions to the Company. 
+This Contribution License Agreement (the “**CLA**”) is between the individual set forth in the signature block (“**You**”) and Inversoft, LLC., dba FusionAuth and Permify (the “**Company**”), effective as of the date of Your signature and sets forth the terms pursuant to which You provide Contributions to the Company. 
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
This Contribution License Agreement (the **CLA**) is between the individual set forth in the signature block (**You**) and Inversoft, LLC., dba FusionAuth and Permify (the **Company**), effective as of the date of Your signature and sets forth the terms pursuant to which You provides Contributions to the Company.
This Contribution License Agreement (the "**CLA**") is between the individual set forth in the signature block ("**You**") and Inversoft, LLC., dba FusionAuth and Permify (the "**Company**"), effective as of the date of Your signature and sets forth the terms pursuant to which You provide Contributions to the Company.
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.

In `@CLA.md` at line 3, The opening clause contains a grammatical error: change
the phrase "You provides Contributions" to "You provide Contributions" in the
sentence that reads 'the individual set forth in the signature block (“You”) ...
and sets forth the terms pursuant to which You provides Contributions to the
Company.' Update that exact wording so the subject-verb agreement is correct
while preserving the surrounding legal phrasing (keep "the individual set forth
in the signature block (“You”)" and "sets forth the terms pursuant to which"
intact).


You accept and agree to the following terms and conditions for Your present and future Contributions submitted to the Company. In return, the Company will not use Your Contributions in a way that is contrary to the Company’s business objectives. Except for the license granted herein to the Company and recipients of software distributed by the Company, You reserve all right, title, and interest in and to Your Contributions.

1. Definitions. “**Contribution**” means any original work of authorship, including any modifications or additions to an existing work, that You intentionally submit to the Company for inclusion in, or documentation of, any of the products owned or managed by the Company (the “**Work**”). “**Submit**” means any form of electronic, verbal, or written communication sent to the Company or its representatives, including but not limited to communication on electronic mailing lists, source code control systems, and issue tracking systems that are managed by, or on behalf of, the Company for the purpose of discussing and improving the Work, but excluding communication that is conspicuously marked or otherwise designated in writing by You as “Not a Contribution.”

2. Copyright License. Subject to the terms and conditions of this CLA, You hereby grant to the Company and to recipients of software distributed by the Company a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Your Contributions and such derivative works.

3. Patent License. Subject to the terms and conditions of this CLA, You hereby grant to the Company and to recipients of software distributed by the Company a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable (except as stated in this section) patent license to make, have made, use, offer to sell, sell, import, and otherwise transfer the Work, where such license applies only to those patent claims licensable by You that are necessarily infringed by Your Contribution(s) alone or by combination of Your Contribution(s) with the Work to which such Contribution(s) was submitted. If any entity institutes patent litigation against You or any other entity (including a cross-claim or counterclaim in a lawsuit) alleging that Your Contribution, or the Work to which You have contributed, constitutes direct or contributory patent infringement, then any patent licenses granted to that entity under this CLA for that Contribution or Work will terminate as of the date such litigation is filed.

4. Representations and Warranties. You represent and warrant to the Company that:

1. You are legally entitled to grant the above license, and if Your employer(s) has rights to intellectual property that You create that includes Your Contributions, then You represent and warrant that You have received permission to make Contributions on behalf of that employer, that Your employer has waived such rights for Your Contributions to the Company, or that Your employer has executed a separate CLA with the Company;

2. Each of Your Contributions is Your original creation (see section 6 for submissions on behalf of others); and

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

weird spacing.

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Are you referring to the indentations on this?



3. Your Contribution submissions include complete details of any third-party license or other restriction (including, but not limited to, related patents and trademarks) of which You are personally aware and which are associated with any part of Your Contributions.


Comment thread
brob marked this conversation as resolved.

5. Support; Disclaimer. You are not expected to provide support for Your Contributions, except to the extent You desire to do so. You may provide support for free, for a fee, or not at all. Unless required by applicable law or agreed to in writing, You provide Your Contributions on an “AS IS” BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied, including, without limitation, any warranties or conditions of TITLE, NON- INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A PARTICULAR PURPOSE.

6. Third Party Works. If You wish to submit work that is not Your original creation, then You may submit it to the Company separately from any Contribution, identifying the complete details of its source and of any license or other restriction (including, but not limited to, related patents, trademarks, and license agreements) of which You are personally aware, and conspicuously marking the work as “Submitted on behalf of a third-party: \[named here\]”.

7. You agree to notify the Company of any facts or circumstances of which You become aware that would make Your representations in this CLA inaccurate in any respect.

8. General. This CLA is the entire understanding and agreement with respect to the subject matter hereof, and supersedes any and all prior or contemporaneous representations, understandings, and agreements, between the parties regarding same. If any part of this CLA is found to be unenforceable, the remaining portions of this CLA will remain in full force and effect. No modification of or amendment to this CLA, nor any waiver of any rights under this CLA, will be effective unless in writing signed by the party to be charged, and the waiver of any breach or default will not constitute a waiver of any other right under this CLA or any subsequent breach or default. Nothing in this CLA creates and the parties do not intend to create, any partnership or joint venture between themselves. Either party may freely assign this CLA. This CLA is binding upon and will inure to the benefit of a party’s successors and permitted assigns. This CLA will be governed by the laws of the State of New York. Exclusive jurisdiction of any and all disputes hereunder will be in the state and federal courts in New York, New York. This CLA may be executed in counterparts with the same effect as if all signatories had signed the same document.
Comment thread
brob marked this conversation as resolved.
2 changes: 1 addition & 1 deletion CONTRIBUTING.md
Original file line number Diff line number Diff line change
Expand Up @@ -34,6 +34,7 @@ If you have any questions or need help with a specific issue, feel free to reach
- Make necessary changes and commit those changes. Make sure to test your changes.
- Push changes to your branch.
- Submit your changes for review.
- If you haven't already, sign the contributor license agreement ([CLA](CLA.md)).

## Commit convention

Expand Down Expand Up @@ -82,4 +83,3 @@ If you found any bug, have feature request or just want to improve our code base

You can create an issue and contribute to anything you want, but please ensure to follow the steps above. We will definitely ease your work and help on anything when needed.


Loading