1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
name: "CLA"
on:
# Run on pull_request_target, so we run with the base version of this file.
# This ensures we don't provide secrets to unreviewed action code.
pull_request_target:
types:
# Run on issue_comment to retrigger on "recheck" or "I hereby sign" comments
issue_comment:
types:
# We explicitly configure permissions, as our GITHUB_TOKEN defaults to read-only.
permissions:
# Writing contents isn't needed as signatures are in a remote repository.
contents: read
# Necessary to indicate success/failure of the action.
statuses: write
# Necessary to relaunch the action on signing of the CLA.
actions: write
# Necessary to comment on the PR
pull-requests: write
jobs:
assistant:
name: "CLA Assistant"
runs-on: ubuntu-latest
steps:
- uses: contributor-assistant/github-action@v2.6.1
if: (github.event.comment.body == 'recheck' || github.event.comment.body == 'I have read the CLA Document and I hereby sign the CLA') || github.event_name == 'pull_request_target'
env:
# Automaticaly created by GitHub Actions with the above permissions
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
# This is josephlr@'s PAT, and is stored as an Organization Secret.
# TODO: Move to GitHub App Authentication, when that's supported, see
# https://github.com/contributor-assistant/github-action/issues/172.
PERSONAL_ACCESS_TOKEN: ${{ secrets.CLASIG_PAT }}
with:
# Our CLA Document, update the path in the governance repo changes.
path-to-document: "https://github.com/tpm-rs/governance/blob/main/project-docs/CONTRIBUTOR-LICENSE-AGREEMENT.md"
# Signature repo: https://github.com/tpm-rs/cla-signatures/tree/main/
# If that repo changes, update the values below:
path-to-signatures: "${{ github.event.repository.name }}.json"
branch: "main"
remote-repository-name: "cla-signatures"
# remote-organization-name: "tpm-rs"
# Allow certain users (like bots) to bypass the CLA check
# allowlist: bot*
# Optional inputs:
# create-file-commit-message: 'For example: Creating file for storing CLA Signatures'
# signed-commit-message: 'For example: $contributorName has signed the CLA in $owner/$repo#$pullRequestNo'
# custom-notsigned-prcomment: 'pull request comment with Introductory message to ask new contributors to sign'
# custom-pr-sign-comment: 'The signature to be committed in order to sign the CLA'
# custom-allsigned-prcomment: 'pull request comment when all contributors has signed, defaults to **CLA Assistant Lite bot** All Contributors have signed the CLA.'
# lock-pullrequest-aftermerge: false - if you don't want this bot to automatically lock the pull request after merging (default - true)
# use-dco-flag: true - If you are using DCO instead of CLA