Add CLA, CONTRIBUTING.md, and CLA Assistant workflow - #15
Merged
Conversation
Fixes two errors found in review before committing: CLA.md and the bot's PR comment both incorrectly named Apache-2.0 as the project's license (actual license is MIT, per LICENSE/Cargo.toml/CONTRIBUTING.md's own License section); the CLA document link pointed at a nonexistent `main` branch instead of the repo's actual default branch, `master`. Also drops the unneeded `actions: write` permission and documents the one-time CLA_SIGNATURES_TOKEN secret setup the workflow requires.
…G.md Small documentation-only additions: inline comments explaining the CLA workflow's config choices (trigger condition, SHA pin, signatures branch, allowlist, friendlier bot message), and a CONTRIBUTING.md note on the /reopen issue-comment convention.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adds a Contributor License Agreement (
CLA.md), aCONTRIBUTING.md, and a CLA Assistant GitHub Actions workflow (.github/workflows/cla.yml) that requires contributors to sign the CLA before their first PR merges.What
CLA.md— standard Apache-ICLA-style contributor license agreement, granting the maintainer copyright/patent license (including relicensing rights) while contributions stay MIT-licensed to the public.CONTRIBUTING.md— quickstart, quality bar (cargo fmt --check,clippy -D warnings,test), repo structure, PR guidelines, and CLA-signing instructions..github/workflows/cla.yml— contributor-assistant/github-action (pinned to an exact commit SHA, not a mutable tag), triggered onpull_request_target+issue_comment, storing signatures on acla-signaturesbranch.Fixes applied during review (before committing)
This work was drafted directly in the working tree (uncommitted, untracked) rather than on its own branch. Reviewing it before committing surfaced two real bugs, both now fixed:
CLA.md§8 and the bot's automated PR comment both said the project is licensed under Apache-2.0 — the actual license (perLICENSE,Cargo.toml, andCONTRIBUTING.md's own "License" section) is MIT. Both now correctly say MIT.path-to-documentand the PR-comment link both pointed at.../blob/main/CLA.md— the repo's actual default branch ismaster, notmain. Both now point atmaster.Also: dropped the unused
actions: writepermission (onlycontents/pull-requests/statusesare actually used), and added a comment documenting the one-timeCLA_SIGNATURES_TOKENrepo secret the workflow needs (a PAT withContents: write) — without it, the workflow will fail on first run sinceGITHUB_TOKENalone can't push tocla-signatures.Setup required before merge
CLA_SIGNATURES_TOKENrepo secret must be created (fine-grained PAT,Contents: writeon this repo) or the workflow will fail the first time it runs.Test Plan
LICENSE/Cargo.toml/CONTRIBUTING.md/CLA.md/cla.yml; both CLA links point atmaster; the third-party action's pin is an exact commit SHA.CLA_SIGNATURES_TOKENsecret configured, then a real test PR from a non-allowlisted account to confirm the bot comments/blocks correctly).Checklist
CLA_SIGNATURES_TOKENsecret configured (maintainer setup step, not part of this diff)