From 86edbc640d779a0bff3dfb3ab369a443eb717b59 Mon Sep 17 00:00:00 2001 From: ignacionelson Date: Mon, 21 Sep 2026 18:26:43 -0300 Subject: [PATCH] Remove the duplicate custom-pr-sign-comment that broke the CLA workflow c9a4b552 added custom-pr-sign-comment to close a hole that was not there: the key was already set further down the same block, with the same value, and has been since 2.0.0. The action was already comparing the whole comment, so a comment wrapping the phrase in other text was never recorded as a signature, and loosening the job filter in 0a7330d5 opened nothing. The second copy made the file invalid, and GitHub stopped running the CLA check at all. This removes the copy and says at the original why it is set, since it repeats the action's default phrase and looks removable. --- .github/workflows/cla.yml | 14 ++++++-------- 1 file changed, 6 insertions(+), 8 deletions(-) diff --git a/.github/workflows/cla.yml b/.github/workflows/cla.yml index f3824776..af1ec675 100644 --- a/.github/workflows/cla.yml +++ b/.github/workflows/cla.yml @@ -69,14 +69,6 @@ jobs: allowlist: dependabot[bot],renovate[bot],*[bot] - # Set to the action's own default phrase, and it matters that it - # is set. Without it the action searches the comment for the - # phrase, so "I LIE, I have read the CLA Document and I hereby sign - # the CLA. I do not sign it" on one line was recorded as a - # signature. With it, the comment -- trimmed and lowercased -- - # must be the phrase and nothing else. - custom-pr-sign-comment: 'I have read the CLA Document and I hereby sign the CLA' - custom-notsigned-prcomment: | Thanks for the pull request! @@ -89,6 +81,12 @@ jobs: Please read the **[CLA]($pathToCLADocument)**, then post exactly this as a comment on this pull request: + # Not decoration, although it repeats the action's default phrase. + # Set, it makes the action compare the whole comment, trimmed and + # lowercased, against it. Unset, the action searches the comment + # for the phrase instead, and "I LIE, I have read the CLA Document + # and I hereby sign the CLA. I do not sign it" on one line would + # be recorded as a signature. custom-pr-sign-comment: 'I have read the CLA Document and I hereby sign the CLA' custom-allsigned-prcomment: 'CLA signed — thanks. A maintainer will review this shortly.' lock-pullrequest-aftermerge: false