name: "CLA Assistant"
on:
issue_comment:
types: [created]
pull_request_target:
types: [opened, closed, synchronize]
permissions:
actions: write
contents: write
pull-requests: write
statuses: write
jobs:
CLAAssistant:
runs-on: ubuntu-latest
steps:
- name: Generate token from GitHub App
id: app-token
uses: actions/create-github-app-token@v1
with:
app-id: ${{ secrets.APP_ID }}
private-key: ${{ secrets.APP_PRIVATE_KEY }}
owner: blacklanternsecurity
- name: Check org membership
id: membership
env:
GH_TOKEN: ${{ steps.app-token.outputs.token }}
run: |
if [ "${{ github.event_name }}" = "pull_request_target" ]; then
AUTHOR="${{ github.event.pull_request.user.login }}"
else
PR_NUM="${{ github.event.issue.number }}"
AUTHOR=$(gh api "repos/${{ github.repository }}/pulls/$PR_NUM" --jq '.user.login' 2>/dev/null)
fi
if [ -n "$AUTHOR" ] && gh api "orgs/blacklanternsecurity/members/$AUTHOR" > /dev/null 2>&1; then
echo "is_member=true" >> "$GITHUB_OUTPUT"
else
echo "is_member=false" >> "$GITHUB_OUTPUT"
fi
- name: Skip CLA for org members
if: steps.membership.outputs.is_member == 'true' && github.event_name == 'pull_request_target'
env:
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
run: |
gh api --method POST "repos/${{ github.repository }}/statuses/${{ github.event.pull_request.head.sha }}" \
-f state=success \
-f context="CLAAssistant" \
-f description="CLA check skipped — author is an org member"
- name: "CLA Assistant"
if: |
(steps.membership.outputs.is_member != 'true') &&
((github.event.comment.body == 'recheck' || github.event.comment.body == 'I have read the CLA Document and I hereby sign the CLA') || github.event_name == 'pull_request_target')
uses: contributor-assistant/github-action@v2.6.1
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
PERSONAL_ACCESS_TOKEN: ${{ steps.app-token.outputs.token }}
with:
path-to-signatures: "signatures/version1/cla.json"
path-to-document: "https://github.com/blacklanternsecurity/CLA/blob/main/ICLA.md"
branch: "main"
allowlist: "dependabot[bot],github-actions[bot],renovate[bot]"
remote-organization-name: "blacklanternsecurity"
remote-repository-name: "CLA"
lock-pullrequest-aftermerge: "false"