From 01aa119f338fb674e5feb9586dc520593cc615c5 Mon Sep 17 00:00:00 2001
From: ajianaz <ajianaz@users.noreply.github.com>
Date: Fri, 11 Sep 2026 11:38:29 +0700
Subject: [PATCH] fix(ci): make cla-check work for fork PRs
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The CLA gate relied on a manually POSTed commit status. Fork PRs run
workflows with a read-only GITHUB_TOKEN regardless of declared
permissions, so the status step always 403s on forks — every external
fork PR was permanently red even with a signed CLA. The bot comment
step also 403s on forks.

- Drop the commit-status step and statuses:write; the gate now rides
  on this job's own Actions check run (fork-safe by construction).
- Comment step becomes same-repo-only + continue-on-error (courtesy,
  never a gate). Unsigned path emits a ::error annotation with the
  portal link instead.
- github-script upgraded to v9.

Validated end-to-end on codecoradev/uteke (PR #1224 + E2E probe).
---
 .github/workflows/cla-check.yml | 28 +++++-----------------------
 1 file changed, 5 insertions(+), 23 deletions(-)

diff --git a/.github/workflows/cla-check.yml b/.github/workflows/cla-check.yml
index 98820d7..0e30952 100644
--- a/.github/workflows/cla-check.yml
+++ b/.github/workflows/cla-check.yml
@@ -7,7 +7,6 @@ on:
 permissions:
   pull-requests: write
   contents: read
-  statuses: write
 
 jobs:
   cla-check:
@@ -46,9 +45,10 @@ jobs:
         env:
           PR_AUTHOR: ${{ github.event.pull_request.user.login }}
 
-      - name: Comment on PR (unsigned only)
-        if: steps.check.outputs.signed != 'true'
-        uses: actions/github-script@v7
+      - name: Comment on PR (same-repo, best effort)
+        if: steps.check.outputs.signed != 'true' && github.event.pull_request.head.repo.full_name == github.repository
+        continue-on-error: true
+        uses: actions/github-script@v9
         with:
           script: |
             const author = '${{ github.event.pull_request.user.login }}';
@@ -96,27 +96,9 @@ jobs:
               });
             }
 
-      - name: Set commit status
-        uses: actions/github-script@v7
-        with:
-          script: |
-            const signed = '${{ steps.check.outputs.signed }}' === 'true';
-            await github.rest.repos.createCommitStatus({
-              owner: context.repo.owner,
-              repo: context.repo.repo,
-              sha: '${{ github.event.pull_request.head.sha }}',
-              state: signed ? 'success' : 'failure',
-              context: 'CLA Check',
-              description: signed
-                ? '✅ CLA signed'
-                : '❌ CLA not signed — sign at https://codecoradev.github.io/cla',
-              target_url: signed
-                ? 'https://github.com/codecoradev/.github/blob/main/.cla/signatures.json'
-                : 'https://codecoradev.github.io/cla',
-            });
-
       - name: Fail if not signed
         if: steps.check.outputs.signed != 'true'
         run: |
+          echo "::error title=CLA not signed::Sign the CodeCoraDev CLA at https://codecoradev.github.io/cla — once the signature PR is merged, this check turns green automatically (re-run it or wait ~1 hour)."
           echo "❌ CLA not signed by ${{ github.event.pull_request.user.login }}"
           exit 1