backlog: file item 1312 -- the release-age guardrail test passes off the live network #1430
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CLA Assistant | |
| # Requires every PR contributor to agree to CLA.md before their PR can be merged. | |
| # Signatures are recorded in-repo on the `cla-signatures` branch, so no extra secret is | |
| # needed — the default GITHUB_TOKEN (with contents: write below) is sufficient. | |
| # | |
| # NOTE: pull_request_target workflows only run from the DEFAULT branch, so this takes effect | |
| # once it is merged to main. Signing IS already mandatory: the required status-check context is | |
| # `cla` -- the JOB key below, because that job declares no `name:`. It is NOT "CLA Assistant", | |
| # which is this WORKFLOW's name and matches no status check; adding that string to branch | |
| # protection would wedge every PR forever (docs/CI.md, "the required-but-absent trap"). | |
| # See .github/required-contexts.txt. | |
| on: | |
| issue_comment: | |
| types: [created] | |
| pull_request_target: | |
| # No `closed` (CI cost): the action's on-close behavior (locking the sign-comment thread) is | |
| # moot while every author is allowlisted below — each merged/closed PR was billing a 1-min | |
| # runner to do nothing. Signing enforcement lives on the opened/synchronize runs + the required | |
| # `cla` status context, both untouched. | |
| # | |
| # NOTE: this previously read "moot on this private repo". The repo is PUBLIC, so the re-add | |
| # condition is no longer hypothetical — a fork PR from a non-allowlisted contributor is | |
| # possible today. It is the ALLOWLIST, not repo visibility, that currently makes the on-close | |
| # behavior unnecessary. Re-add `closed` if/when such PRs are accepted. | |
| types: [opened, synchronize] | |
| permissions: | |
| actions: write | |
| contents: write | |
| pull-requests: write | |
| statuses: write | |
| jobs: | |
| cla: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: CLA Assistant | |
| if: >- | |
| (github.event.comment.body == 'recheck' || | |
| github.event.comment.body == 'I have read the CLA and I agree to its terms.') || | |
| github.event_name == 'pull_request_target' | |
| uses: contributor-assistant/github-action@ca4a40a7d1004f18d9960b404b97e5f30a505a08 # v2.6.1 | |
| env: | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| with: | |
| path-to-document: 'https://github.com/MEFORORG/MessageFoundry/blob/main/CLA.md' | |
| path-to-signatures: 'signatures/version1/cla.json' | |
| branch: 'cla-signatures' | |
| custom-pr-sign-comment: 'I have read the CLA and I agree to its terms.' | |
| custom-notsigned-prcomment: >- | |
| Thanks for your contribution! Before we can merge it, please read our | |
| [Contributor License Agreement](https://github.com/MEFORORG/MessageFoundry/blob/main/CLA.md) | |
| and sign it by posting the comment below. | |
| custom-allsigned-prcomment: 'All contributors have signed the CLA. ✅' | |
| # The maintainer and known bot accounts don't need to sign. Enumerate the actual bots — | |
| # a `bot*` glob would let any human whose username starts with "bot" skip signing (low-28). | |
| allowlist: 'wshallwshall,dependabot[bot],github-actions[bot]' |