From c842015af94a534068c211a1be6c8867810322de Mon Sep 17 00:00:00 2001 From: Ritwik G Date: Tue, 27 Oct 2026 14:08:45 +0530 Subject: [PATCH 1/3] ci: enforce the CLA with Zipstack/cla-action instead of cla-assistant.io cla-assistant.io's outages leave the required license/cla check stuck and block PRs. The new workflow sets the same license/cla status, so the ruleset needs no change. Signatures (41 imported from cla-assistant.io) live in the private Zipstack/cla-signatures repo. (UN-4523) Co-Authored-By: Claude Opus 5.5 --- .github/workflows/cla.yaml | 43 ++++++++++++++++++++++++++++++++++++++ 1 file changed, 43 insertions(+) create mode 100644 .github/workflows/cla.yaml diff --git a/.github/workflows/cla.yaml b/.github/workflows/cla.yaml new file mode 100644 index 0000000000..7e14c140d8 --- /dev/null +++ b/.github/workflows/cla.yaml @@ -0,0 +1,43 @@ +# Requires every contributor to have signed the Zipstack CLA, and records +# signatures posted as a PR comment. Replaces cla-assistant.io; it sets the same +# `license/cla` status that branch protection requires. +# See https://github.com/Zipstack/cla-action +# +# pull_request_target runs in the context of the base repository, so it gets +# secrets even for PRs from forks. That is safe here only because this workflow +# never checks out or runs the PR's code. Do not add a checkout step. +name: CLA + +on: + pull_request_target: + types: [opened, synchronize, reopened] + issue_comment: + types: [created] + +permissions: + pull-requests: write + statuses: write + +concurrency: + group: cla-${{ github.event.pull_request.number || github.event.issue.number }} + +jobs: + cla: + # Comments on issues (not PRs) never need a CLA check. + if: github.event_name == 'pull_request_target' || github.event.issue.pull_request + runs-on: ubuntu-latest + steps: + - name: Mint signatures token + id: app-token + uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510 # v3.3.0 + with: + client-id: ${{ vars.CLA_APP_CLIENT_ID }} + private-key: ${{ secrets.CLA_APP_PRIVATE_KEY }} + owner: Zipstack + repositories: cla-signatures + + - uses: Zipstack/cla-action@b68f7dda08f8e4d075b2c357609e20e5ef6f646e # v1.0.0 + with: + cla-document-url: https://gist.github.com/arun-venkataswamy/0dec44b8e5155c43461caf62c38ddac3 + signatures-repository: Zipstack/cla-signatures + signatures-token: ${{ steps.app-token.outputs.token }} From a0e0d3729a5e405ffe9eeda1f647a54bc284af1e Mon Sep 17 00:00:00 2001 From: Ritwik G Date: Tue, 27 Oct 2026 14:31:59 +0530 Subject: [PATCH 2/3] ci: pass Dependabot PRs on license/cla and replace the cla-assistant badge Dependabot-triggered runs get no Actions secrets, so minting the signatures token would fail and leave license/cla pending (as it already is under cla-assistant on #2226 and #2190). Set the status directly for those runs; anyone else's run on a Dependabot PR still goes through the action. The README badge pointed at cla-assistant.io, which we unlink at cutover; it now links to the CLA itself. Co-Authored-By: Claude Opus 5.5 --- .github/workflows/cla.yaml | 20 +++++++++++++++++++- README.md | 2 +- 2 files changed, 20 insertions(+), 2 deletions(-) diff --git a/.github/workflows/cla.yaml b/.github/workflows/cla.yaml index 7e14c140d8..e93a21a10a 100644 --- a/.github/workflows/cla.yaml +++ b/.github/workflows/cla.yaml @@ -27,7 +27,24 @@ jobs: if: github.event_name == 'pull_request_target' || github.event.issue.pull_request runs-on: ubuntu-latest steps: + # Runs triggered by Dependabot get only Dependabot secrets, so the token + # step below would fail and leave the check pending. Dependabot is exempt + # from the CLA anyway, so set the status directly. Comments Dependabot + # posts need no check. Runs triggered by anyone else on a Dependabot PR + # still go through the action. + - name: Pass Dependabot runs + if: github.actor == 'dependabot[bot]' && github.event_name == 'pull_request_target' + env: + GH_TOKEN: ${{ github.token }} + REPO: ${{ github.repository }} + SHA: ${{ github.event.pull_request.head.sha }} + run: >- + gh api -X POST "repos/$REPO/statuses/$SHA" + -f state=success -f context=license/cla + -f description="Dependabot pull request; no CLA needed." + - name: Mint signatures token + if: github.actor != 'dependabot[bot]' id: app-token uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510 # v3.3.0 with: @@ -36,7 +53,8 @@ jobs: owner: Zipstack repositories: cla-signatures - - uses: Zipstack/cla-action@b68f7dda08f8e4d075b2c357609e20e5ef6f646e # v1.0.0 + - if: github.actor != 'dependabot[bot]' + uses: Zipstack/cla-action@b68f7dda08f8e4d075b2c357609e20e5ef6f646e # v1.0.0 with: cla-document-url: https://gist.github.com/arun-venkataswamy/0dec44b8e5155c43461caf62c38ddac3 signatures-repository: Zipstack/cla-signatures diff --git a/README.md b/README.md index 9e282b3e10..8544270e4c 100644 --- a/README.md +++ b/README.md @@ -12,7 +12,7 @@ Uptime Status Docker Pulls Ask DeepWiki - CLA assistant + CLA required

Python Version from PEP 621 TOML From 3738fe2401815308b116a5a7c82a87d449b0901c Mon Sep 17 00:00:00 2001 From: Ritwik G Date: Tue, 27 Oct 2026 14:37:59 +0530 Subject: [PATCH 3/3] ci: drop the Dependabot pass step from the CLA workflow The step assumed Dependabot-triggered runs get only Dependabot secrets. That is wrong for pull_request_target: GitHub restricts it only when the PR's base ref was created by Dependabot. A normal Dependabot PR onto main gets the Actions secrets, and the action exempts it as *[bot]. The step also opened a bypass. It keyed on github.actor, which an outside contributor can make read dependabot[bot] by having Dependabot in their fork re-push the PR branch (`@dependabot recreate`). That posted license/cla=success on unsigned commits and skipped the real check. The workflow steps go back to the earlier version. The README badge change is kept. Co-Authored-By: Claude Opus 5.5 --- .github/workflows/cla.yaml | 20 +------------------- 1 file changed, 1 insertion(+), 19 deletions(-) diff --git a/.github/workflows/cla.yaml b/.github/workflows/cla.yaml index e93a21a10a..7e14c140d8 100644 --- a/.github/workflows/cla.yaml +++ b/.github/workflows/cla.yaml @@ -27,24 +27,7 @@ jobs: if: github.event_name == 'pull_request_target' || github.event.issue.pull_request runs-on: ubuntu-latest steps: - # Runs triggered by Dependabot get only Dependabot secrets, so the token - # step below would fail and leave the check pending. Dependabot is exempt - # from the CLA anyway, so set the status directly. Comments Dependabot - # posts need no check. Runs triggered by anyone else on a Dependabot PR - # still go through the action. - - name: Pass Dependabot runs - if: github.actor == 'dependabot[bot]' && github.event_name == 'pull_request_target' - env: - GH_TOKEN: ${{ github.token }} - REPO: ${{ github.repository }} - SHA: ${{ github.event.pull_request.head.sha }} - run: >- - gh api -X POST "repos/$REPO/statuses/$SHA" - -f state=success -f context=license/cla - -f description="Dependabot pull request; no CLA needed." - - name: Mint signatures token - if: github.actor != 'dependabot[bot]' id: app-token uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510 # v3.3.0 with: @@ -53,8 +36,7 @@ jobs: owner: Zipstack repositories: cla-signatures - - if: github.actor != 'dependabot[bot]' - uses: Zipstack/cla-action@b68f7dda08f8e4d075b2c357609e20e5ef6f646e # v1.0.0 + - uses: Zipstack/cla-action@b68f7dda08f8e4d075b2c357609e20e5ef6f646e # v1.0.0 with: cla-document-url: https://gist.github.com/arun-venkataswamy/0dec44b8e5155c43461caf62c38ddac3 signatures-repository: Zipstack/cla-signatures