dev · L-261007-7d36d7

.github/workflows/cla.yml

@@ -17,15 +17,18 @@ jobs:
   CLAAssistant:
     # The file also triggers in this repository, which holds it and asks no CLA of its own.
     if: github.repository != 'Pipelex/.github'
-    runs-on: ubuntu-latest
+    # A pinned image, so a move of `ubuntu-latest` never changes the runner under the CLA check.
+    runs-on: ubuntu-24.04
     steps:
       # The App's token is used for one thing, writing signatures into cla-signatures, the only
       # repository its installation reaches; the comments and the check use the workflow's token.
       - name: Get GitHub App token
         id: app-token
         uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
         with:
-          app-id: ${{ secrets.CLA_GH_APP_ID }}
+          # The client id of the App `pipelex-cla-signatures-read-access`, which is public
+          # (`gh api apps/pipelex-cla-signatures-read-access`); only its private key is a secret.
+          client-id: Iv23li4tzbte0fxKqXH1
           private-key: ${{ secrets.CLA_GH_APP_PRIVATE_KEY }}
           owner: ${{ github.repository_owner }}
           repositories: cla-signatures
@@ -58,6 +61,18 @@ jobs:
           OLD="$old" NEW="$new" perl -pi -e 's/\Q$ENV{OLD}\E/$ENV{NEW}/' "$file"
           test "$(grep -cF -- "$new" "$file")" = 1
 
+      # v2.6.1 declares Node.js 20, which GitHub deprecated and already runs on Node.js 24, so
+      # the action is declared for the runtime it runs on.
+      - name: Declare the action for Node.js 24
+        run: |
+          file=.cla-assistant/action.yml
+          if [ "$(grep -cF -- 'using: "node20"' "$file")" != 1 ]; then
+            echo "::error::The runtime is not declared where v2.6.1 declares it."
+            exit 1
+          fi
+          sed -i 's/using: "node20"/using: "node24"/' "$file"
+          test "$(grep -cF -- 'using: "node24"' "$file")" = 1
+
       - name: CLA Assistant
         uses: ./.cla-assistant
         env:

docs/cla.md

@@ -2,7 +2,7 @@
 
 Every public Pipelex repository that asks contributors to sign a contributor licence agreement runs the CLA Assistant from one workflow, [`.github/workflows/cla.yml`](../.github/workflows/cla.yml) here, and carries no copy of it.
 
-**Which repositories run it is declared in `github-manager`**, in `config/organization.yaml`, in two places side by side: the organization ruleset `cla`, whose `repository_ids` are the repositories it covers and which requires this workflow on pull requests into their `dev`, and the organization secrets `CLA_GH_APP_ID` and `CLA_GH_APP_PRIVATE_KEY`, granted to the same repositories. Adding a repository means adding it to both, in one pull request there; the repository itself needs nothing.
+**Which repositories run it is declared in `github-manager`**, in `config/organization.yaml`, in two places side by side: the organization ruleset `cla`, whose `repository_ids` are the repositories it covers and which requires this workflow on pull requests into their `dev`, and the organization secret `CLA_GH_APP_PRIVATE_KEY`, granted to the same repositories. Adding a repository means adding it to both, in one pull request there; the repository itself needs nothing. The App's client id is public, so the workflow names it rather than reading a secret.
 
 GitHub runs the workflow as it is on this repository's `main`, in the context of the pull request's repository: the secrets it reads are the ones granted to that repository, the allowlist is the organization variable `CLA_ALLOWLIST`, and the document it asks a contributor to sign is [`CLA.md`](../CLA.md) at the root of this repository, one agreement for every Pipelex project. A repository may still carry its own copy for its readers, but the bot links this one. Signatures are recorded in `Pipelex/cla-signatures`, so a contributor who signs once is signed for every repository. A change to the workflow therefore reaches every repository when `dev` is promoted to `main` here.
 
@@ -15,3 +15,5 @@ The workflow runs [`contributor-assistant/github-action`](https://github.com/con
 The changed line is the action's re-run guard. Once every contributor has signed, the action re-runs the last failed run of its own workflow on the pull request's branch. That turns a check that failed before a signature by comment green without a new push. To find that run it looks its workflow up by name in the pull request's repository, and it throws when the workflow is not there. A workflow that a ruleset requires lives here, so the lookup always fails, and the job failed after logging "All contributors have signed the CLA" (`Unable to locate this workflow's ID in this repository, can't trigger job..`).
 
 The re-run serves a signature given in a comment, and a ruleset never runs this workflow on a comment, so it has nothing to do here. The action already skips it on `pull_request`, and the patch makes it skip it on `pull_request_target` too. Without the re-run, nothing in the job uses the `actions: write` permission, so the workflow no longer asks for it. The patch step refuses to run the action when the line it replaces is missing, so changing the pinned commit cannot quietly run an unpatched copy.
+
+A second edit declares the action for Node.js 24 in its `action.yml`, where v2.6.1 still declares Node.js 20, which GitHub has deprecated and already replaces with Node.js 24 when it runs the action; the step likewise refuses to run when the declaration is not where v2.6.1 has it.