Sourced from iainmcgin/cla-github-action's changelog.

Changelog

All notable changes to this fork since it diverged from the upstream cla-assistant/github-action project (archived). The branch point is commit 58daaf8 "Update README to reflect repository status".

Versioning starts at v3.0.0, the first major version after the upstream project's final release (v2.7.1), to make clear this is a divergent line. Changes are grouped by the logical unit of work; each entry links to the commit that introduced it.

Unreleased

Nothing yet.

v3.2.0 — 2026-06-17

Changed

• CLA sign-comment matching tolerates a small amount of surrounding text. (1f440bd) A comment now counts as a signature when the configured phrase appears on its own line (or its own block of lines, for a multi-line custom-pr-sign-comment), case-insensitive, with trailing ./! ignored, and any other text in the comment is no longer than the phrase itself (minimum allowance 32 characters). Previously the match failed if the comment contained anything on another line — for example a contributor adding recheck below the declaration. The same rule now applies whether or not custom-pr-sign-comment is set; previously that path required a byte-for-byte match. Note this is also slightly stricter on the matching line itself: text before or after the phrase on the same line (other than trailing punctuation) no longer matches, and a line inside a > Markdown blockquote is never treated as the author's own declaration.

v3.1.0 — 2026-06-09

Fixed

• Pull requests closed without merging are no longer locked. (30dab6b) The lock-pullrequest-aftermerge feature locked the conversation on any closed event, including a contributor closing their own unmerged PR. If the PR was later reopened, the stale lock prevented the bot from commenting and the CLA check could never complete. The lock now only applies when the PR was actually merged.
• Reopened PRs with a stale lock are unlocked automatically. (30dab6b) A merged PR can never be reopened, so a lock found on a reopened PR is either left over from the lock-on-any-close bug above or was set manually by a maintainer; the action cannot tell the two apart and removes it so the CLA check can comment again. Applies only when lock-pullrequest-aftermerge is enabled. The recommended workflow in the README now includes

... (truncated)

• 0d27e5a Cut v3.2.0: promote CHANGELOG Unreleased section to release
• 1f440bd Relax sign-comment matching to tolerate brief surrounding text
• 6dd686d README: update example SHA pin to v3.1.0 (b265428)
• See full diff in compare view

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)