Add CLA Assistant retry workflow

Author: clockwork-labs-bot

.cargo/config.toml

@@ -5,6 +5,7 @@ rustflags = ["--cfg", "tokio_unstable"]
 bump-versions = "run -p upgrade-version --"
 llm = "run --package xtask-llm-benchmark --bin llm_benchmark --"
 ci = "run -p ci --"
+xtask = "run -p xtask --"
 regen = "run -p regen --"
 smoketest = "ci smoketests --"
 smoketests = "smoketest"

.github/workflows/retry-cla-assistant.yml

@@ -0,0 +1,61 @@
+name: Retry CLA Assistant
+
+# CLA Assistant publishes `license/cla` as a commit status, not a check run.
+# If its webhook handler misses a PR update, GitHub branch protection can wait
+# forever even after every real CI check has passed. This workflow nudges CLA
+# Assistant only when that status is the sole remaining non-green signal.
+#
+# SECURITY: This workflow uses pull_request_target so it can inspect PR status
+# for forks, but it must never check out, build, or execute code from the PR.
+
+on:
+  pull_request_target:
+    types: [opened, reopened, synchronize, ready_for_review]
+  workflow_run:
+    workflows:
+      - CI
+      - Internal Tests
+      - CodeQL
+      - Check merge labels
+      - Review Checks
+    types: [completed]
+  workflow_dispatch:
+    inputs:
+      pr_number:
+        description: "Pull request number to check"
+        required: true
+        type: number
+
+permissions:
+  actions: read
+  checks: read
+  contents: read
+  pull-requests: read
+  statuses: read
+
+concurrency:
+  group: retry-cla-assistant-${{ github.event.pull_request.number || github.event.inputs.pr_number || github.run_id }}
+  cancel-in-progress: false
+
+jobs:
+  retry-cla:
+    name: Retry CLA Assistant if it is the only blocker
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Check out trusted base code
+        uses: actions/checkout@v4
+        with:
+          ref: ${{ github.event.repository.default_branch }}
+
+      - uses: dsherret/rust-toolchain-file@v1
+
+      - uses: Swatinem/rust-cache@v2
+        with:
+          cache-all-crates: true
+
+      - name: Recheck CLA Assistant
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          INPUT_PR_NUMBER: ${{ inputs.pr_number }}
+        run: cargo xtask retry-cla-assistant

Cargo.lock

@@ -66,6 +66,7 @@ members = [
   "tools/generate-client-api",
   "tools/gen-bindings",
   "tools/regen",
+  "tools/xtask",
   "tools/xtask-llm-benchmark",
   "crates/bindings-typescript/test-app/server",
   "crates/bindings-typescript/test-react-router-app/server",

Cargo.toml

@@ -0,0 +1,12 @@
+[package]
+name = "xtask"
+version = "0.1.0"
+edition.workspace = true
+
+[dependencies]
+anyhow.workspace = true
+chrono = { workspace = true, features = ["clock"] }
+clap.workspace = true
+reqwest = { workspace = true, features = ["blocking", "json"] }
+serde.workspace = true
+serde_json.workspace = true