Would you sign the Contributor Assignment Agreement? #1
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # .github/workflows/cla.yml -- goes in EACH library repo. | |
| # Blocks a PR from merging until every human commit-author has signed the | |
| # Contributor Assignment Agreement (CAA). Signatures are recorded per GitHub | |
| # user in one central file, so a person signs once and it counts everywhere. | |
| # | |
| # Contributors sign by posting this exact comment on their PR: | |
| # I have read the CAA and I hereby sign it, assigning copyright in my | |
| # contributions to Más Bandwidth LLC. | |
| # | |
| # REQUIRES a repo or org secret named CLA_SIGNATURES_TOKEN (a fine-grained or | |
| # classic PAT with contents + pull-requests write on the library repos and on | |
| # mas-bandwidth/.github). The built-in GITHUB_TOKEN is read-only for pull | |
| # requests from forks, which is exactly the case we need to gate, so the PAT is | |
| # required. Do not commit the token, add it in repo/org Settings -> Secrets. | |
| name: Contributor Assignment Agreement | |
| on: | |
| issue_comment: | |
| types: [created] | |
| pull_request_target: | |
| types: [opened, synchronize] | |
| permissions: | |
| actions: write | |
| contents: read | |
| pull-requests: write | |
| statuses: write | |
| jobs: | |
| caa: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: CAA check | |
| if: (github.event.comment.body == 'I have read the CAA and I hereby sign it, assigning copyright in my contributions to Más Bandwidth LLC.') || github.event_name == 'pull_request_target' | |
| uses: contributor-assistant/github-action@v2.6.1 | |
| env: | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| PERSONAL_ACCESS_TOKEN: ${{ secrets.CLA_SIGNATURES_TOKEN }} | |
| with: | |
| # one central signature store for the whole org -> per-user tracking | |
| remote-organization-name: mas-bandwidth | |
| remote-repository-name: .github | |
| branch: cla-signatures | |
| path-to-signatures: signatures/caa.json | |
| path-to-document: https://github.com/mas-bandwidth/.github/blob/main/CAA.md | |
| # our own accounts and bots never need to sign | |
| allowlist: gafferongames,rowan-claude,*[bot] | |
| custom-notsigned-prcomment: 'Thanks for the contribution. Before it can be merged, please read the [Contributor Assignment Agreement](https://github.com/mas-bandwidth/.github/blob/main/CAA.md) and sign it by posting the exact sentence below as a comment on this PR.' | |
| custom-pr-sign-comment: 'I have read the CAA and I hereby sign it, assigning copyright in my contributions to Más Bandwidth LLC.' | |
| custom-allsigned-prcomment: 'All contributors have signed the CAA. Thank you.' | |
| lock-pullrequest-aftermerge: false |