gsadmin/projectsend
1
0
Fork 0
mirror of https://github.com/projectsend/projectsend.git synced 2026-09-23 03:53:21 +00:00
Code Issues Packages Projects Releases Wiki Activity

Only record a CLA signature when the comment is the phrase

Browse Source 
The action, left to its default, searches a comment for the signing
phrase, so a single line such as "I LIE, I have read the CLA Document
and I hereby sign the CLA. I do not sign it" was recorded as a
signature. The exact match in the job filter used to block that, but
only by accident, and it also blocked @JensS's real signature, which
had line breaks after it. Loosening that filter in 0a7330d5 let both
through.

custom-pr-sign-comment makes the action compare the whole comment,
trimmed and lowercased, against the phrase. Trailing line breaks still
sign; anything else around the phrase does not. The job filter stays
loose, since it only decides whether a runner starts.
This commit is contained in:
ignacionelson
2026-09-21 18:25:14 -03:00
parent 0a7330d5cd
commit c9a4b5520d
1 changed files with 14 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.github/workflows/cla.yml
+14 -7
View File
@@ -42,13 +42,12 @@ jobs:
# request; comments on ordinary issues have nothing for this action to
# check.
#
# Loose on purpose, never `==`. The action matches the signing phrase
# loosely itself -- any case, anything around it -- and this filter has
# to be at least as forgiving, or it throws away signatures the action
# would have accepted. It did: a contributor's signature arrived with
# trailing line breaks ("...sign the CLA\r\n\r\n"), the exact match
# skipped the job, and nothing was recorded. `contains` and
# `startsWith` ignore case here as well.
# Loose on purpose, never `==`. This only decides whether a runner
# starts; whether a comment is a signature is decided by the action,
# strictly, against `custom-pr-sign-comment` below. An exact match here
# threw away a real signature that arrived with trailing line breaks
# ("...sign the CLA\r\n\r\n"), which the action -- it trims first --
# would have accepted. `contains` and `startsWith` ignore case.
if: >-
github.event_name == 'pull_request_target'
|| (github.event.issue.pull_request
@@ -70,6 +69,14 @@ jobs:
allowlist: dependabot[bot],renovate[bot],*[bot]
# Set to the action's own default phrase, and it matters that it
# is set. Without it the action searches the comment for the
# phrase, so "I LIE, I have read the CLA Document and I hereby sign
# the CLA. I do not sign it" on one line was recorded as a
# signature. With it, the comment -- trimmed and lowercased --
# must be the phrase and nothing else.
custom-pr-sign-comment: 'I have read the CLA Document and I hereby sign the CLA'
custom-notsigned-prcomment: |
Thanks for the pull request!