cla-check.yml

name: CLA Check

on:
  pull_request_target:
    types:
      - opened
      - synchronize
      - reopened
      - ready_for_review

jobs:
  cla:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      pull-requests: read
    steps:
      - name: Verify contributor CLA signature
        env:
          CLA_CHECK_SECRET: ${{ secrets.CLA_CHECK_SECRET }}
          PR_AUTHOR: ${{ github.event.pull_request.user.login }}
        run: |
          node -e "
          (async () => {
            const author = process.env.PR_AUTHOR;
            const secret = process.env.CLA_CHECK_SECRET;
            
            if (!author) throw new Error('Missing PR author.');
            if (!secret) throw new Error('Missing CLA_CHECK_SECRET.');

            console.log('Checking CLA signature for @' + author + '...');

            const response = await fetch('https://codra.run/api/internal/check-cla?user=' + encodeURIComponent(author), {
              headers: {
                'x-cla-check-secret': secret,
              },
            });

            if (!response.ok) {
              const body = await response.text();
              throw new Error('API Error ' + response.status + ': ' + body);
            }

            const payload = await response.json();
            if (!payload.signed) {
              console.error('❌ @' + author + ' has not signed the CLA.');
              console.error('Please visit https://codra.run/cla to sign.');
              process.exit(1);
            }

            console.log('✅ CLA confirmed for @' + author + '.');
          })().catch(err => {
            console.error(err.message);
            process.exit(1);
          });
          "