From fa657b831a216be577078b7d43d41c8102e6434f Mon Sep 17 00:00:00 2001 From: Thomas Hebrard Date: Thu, 8 Oct 2026 10:29:31 +0200 Subject: [PATCH] =?UTF-8?q?feature/Cla-warnings=20=C2=B7=20L-261007-7d36d7?= =?UTF-8?q?=20(#49)?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Clears the CLA workflow's warnings: the CLA App is named by its public client id instead of the deprecated `app-id` read from the `CLA_GH_APP_ID` secret, the archived action's `action.yml` is patched from Node.js 20 to Node.js 24 the way its re-run guard already is, and the runner is pinned to `ubuntu-24.04` ahead of `ubuntu-latest` moving to Ubuntu 26. The `pull_request_target` event policy GitHub enforces on 2026-11-02 is declared in github-manager, not here. Advances L-261007-7d36d7 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-authored-by: Claude Opus 5.5 (1M context) --- .github/workflows/cla.yml | 19 +++++++++++++++++-- docs/cla.md | 4 +++- 2 files changed, 20 insertions(+), 3 deletions(-) diff --git a/.github/workflows/cla.yml b/.github/workflows/cla.yml index 8497df1..e6d8f2c 100644 --- a/.github/workflows/cla.yml +++ b/.github/workflows/cla.yml @@ -17,7 +17,8 @@ jobs: CLAAssistant: # The file also triggers in this repository, which holds it and asks no CLA of its own. if: github.repository != 'Pipelex/.github' - runs-on: ubuntu-latest + # A pinned image, so a move of `ubuntu-latest` never changes the runner under the CLA check. + runs-on: ubuntu-24.04 steps: # The App's token is used for one thing, writing signatures into cla-signatures, the only # repository its installation reaches; the comments and the check use the workflow's token. @@ -25,7 +26,9 @@ jobs: id: app-token uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0 with: - app-id: ${{ secrets.CLA_GH_APP_ID }} + # The client id of the App `pipelex-cla-signatures-read-access`, which is public + # (`gh api apps/pipelex-cla-signatures-read-access`); only its private key is a secret. + client-id: Iv23li4tzbte0fxKqXH1 private-key: ${{ secrets.CLA_GH_APP_PRIVATE_KEY }} owner: ${{ github.repository_owner }} repositories: cla-signatures @@ -58,6 +61,18 @@ jobs: OLD="$old" NEW="$new" perl -pi -e 's/\Q$ENV{OLD}\E/$ENV{NEW}/' "$file" test "$(grep -cF -- "$new" "$file")" = 1 + # v2.6.1 declares Node.js 20, which GitHub deprecated and already runs on Node.js 24, so + # the action is declared for the runtime it runs on. + - name: Declare the action for Node.js 24 + run: | + file=.cla-assistant/action.yml + if [ "$(grep -cF -- 'using: "node20"' "$file")" != 1 ]; then + echo "::error::The runtime is not declared where v2.6.1 declares it." + exit 1 + fi + sed -i 's/using: "node20"/using: "node24"/' "$file" + test "$(grep -cF -- 'using: "node24"' "$file")" = 1 + - name: CLA Assistant uses: ./.cla-assistant env: diff --git a/docs/cla.md b/docs/cla.md index e7842b0..dea1255 100644 --- a/docs/cla.md +++ b/docs/cla.md @@ -2,7 +2,7 @@ Every public Pipelex repository that asks contributors to sign a contributor licence agreement runs the CLA Assistant from one workflow, [`.github/workflows/cla.yml`](../.github/workflows/cla.yml) here, and carries no copy of it. -**Which repositories run it is declared in `github-manager`**, in `config/organization.yaml`, in two places side by side: the organization ruleset `cla`, whose `repository_ids` are the repositories it covers and which requires this workflow on pull requests into their `dev`, and the organization secrets `CLA_GH_APP_ID` and `CLA_GH_APP_PRIVATE_KEY`, granted to the same repositories. Adding a repository means adding it to both, in one pull request there; the repository itself needs nothing. +**Which repositories run it is declared in `github-manager`**, in `config/organization.yaml`, in two places side by side: the organization ruleset `cla`, whose `repository_ids` are the repositories it covers and which requires this workflow on pull requests into their `dev`, and the organization secret `CLA_GH_APP_PRIVATE_KEY`, granted to the same repositories. Adding a repository means adding it to both, in one pull request there; the repository itself needs nothing. The App's client id is public, so the workflow names it rather than reading a secret. GitHub runs the workflow as it is on this repository's `main`, in the context of the pull request's repository: the secrets it reads are the ones granted to that repository, the allowlist is the organization variable `CLA_ALLOWLIST`, and the document it asks a contributor to sign is [`CLA.md`](../CLA.md) at the root of this repository, one agreement for every Pipelex project. A repository may still carry its own copy for its readers, but the bot links this one. Signatures are recorded in `Pipelex/cla-signatures`, so a contributor who signs once is signed for every repository. A change to the workflow therefore reaches every repository when `dev` is promoted to `main` here. @@ -15,3 +15,5 @@ The workflow runs [`contributor-assistant/github-action`](https://github.com/con The changed line is the action's re-run guard. Once every contributor has signed, the action re-runs the last failed run of its own workflow on the pull request's branch. That turns a check that failed before a signature by comment green without a new push. To find that run it looks its workflow up by name in the pull request's repository, and it throws when the workflow is not there. A workflow that a ruleset requires lives here, so the lookup always fails, and the job failed after logging "All contributors have signed the CLA" (`Unable to locate this workflow's ID in this repository, can't trigger job..`). The re-run serves a signature given in a comment, and a ruleset never runs this workflow on a comment, so it has nothing to do here. The action already skips it on `pull_request`, and the patch makes it skip it on `pull_request_target` too. Without the re-run, nothing in the job uses the `actions: write` permission, so the workflow no longer asks for it. The patch step refuses to run the action when the line it replaces is missing, so changing the pinned commit cannot quietly run an unpatched copy. + +A second edit declares the action for Node.js 24 in its `action.yml`, where v2.6.1 still declares Node.js 20, which GitHub has deprecated and already replaces with Node.js 24 when it runs the action; the step likewise refuses to run when the declaration is not where v2.6.1 has it.