fix: D32 layer-2 grounds against the union of source-derived texts #47
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Contributor agreement | |
| on: | |
| pull_request_target: | |
| types: [opened, edited, reopened, synchronize] | |
| permissions: {} | |
| jobs: | |
| cla: | |
| name: CLA | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 2 | |
| steps: | |
| # Security invariant: pull_request_target evaluates only event metadata. It must | |
| # never check out, import, or execute code from the untrusted pull-request ref. | |
| - name: Verify contributor assent | |
| env: | |
| PR_AUTHOR: ${{ github.event.pull_request.user.login }} | |
| PR_BODY: ${{ github.event.pull_request.body }} | |
| run: | | |
| python3 - <<'PY' | |
| import os | |
| author = os.environ.get("PR_AUTHOR", "") | |
| if author in {"dependabot[bot]", "github-actions[bot]"}: | |
| raise SystemExit(0) | |
| expected = ( | |
| "- [x] I have read and agree to the " | |
| "[RememberStack Contributor License Agreement v1.0]" | |
| "(https://github.com/writeitai/remember-stack/blob/" | |
| "9e403b25a6d5b0e280cb54dbdfbe900625325940/CLA.md)." | |
| ) | |
| lines = { | |
| line.strip().casefold() | |
| for line in os.environ.get("PR_BODY", "").splitlines() | |
| } | |
| if expected.casefold() not in lines: | |
| print( | |
| "::error::Read CLA.md and check the exact contributor-agreement " | |
| "box in the pull-request body." | |
| ) | |
| raise SystemExit(1) | |
| PY |