From c9a4b5520d2645fada1bc8abe5e41de034237ad8 Mon Sep 17 00:00:00 2001 From: ignacionelson Date: Mon, 21 Sep 2026 18:25:14 -0300 Subject: [PATCH] Only record a CLA signature when the comment is the phrase The action, left to its default, searches a comment for the signing phrase, so a single line such as "I LIE, I have read the CLA Document and I hereby sign the CLA. I do not sign it" was recorded as a signature. The exact match in the job filter used to block that, but only by accident, and it also blocked @JensS's real signature, which had line breaks after it. Loosening that filter in 0a7330d5 let both through. custom-pr-sign-comment makes the action compare the whole comment, trimmed and lowercased, against the phrase. Trailing line breaks still sign; anything else around the phrase does not. The job filter stays loose, since it only decides whether a runner starts. --- .github/workflows/cla.yml | 21 ++++++++++++++------- 1 file changed, 14 insertions(+), 7 deletions(-) diff --git a/.github/workflows/cla.yml b/.github/workflows/cla.yml index 7c1a542e..f3824776 100644 --- a/.github/workflows/cla.yml +++ b/.github/workflows/cla.yml @@ -42,13 +42,12 @@ jobs: # request; comments on ordinary issues have nothing for this action to # check. # - # Loose on purpose, never `==`. The action matches the signing phrase - # loosely itself -- any case, anything around it -- and this filter has - # to be at least as forgiving, or it throws away signatures the action - # would have accepted. It did: a contributor's signature arrived with - # trailing line breaks ("...sign the CLA\r\n\r\n"), the exact match - # skipped the job, and nothing was recorded. `contains` and - # `startsWith` ignore case here as well. + # Loose on purpose, never `==`. This only decides whether a runner + # starts; whether a comment is a signature is decided by the action, + # strictly, against `custom-pr-sign-comment` below. An exact match here + # threw away a real signature that arrived with trailing line breaks + # ("...sign the CLA\r\n\r\n"), which the action -- it trims first -- + # would have accepted. `contains` and `startsWith` ignore case. if: >- github.event_name == 'pull_request_target' || (github.event.issue.pull_request @@ -70,6 +69,14 @@ jobs: allowlist: dependabot[bot],renovate[bot],*[bot] + # Set to the action's own default phrase, and it matters that it + # is set. Without it the action searches the comment for the + # phrase, so "I LIE, I have read the CLA Document and I hereby sign + # the CLA. I do not sign it" on one line was recorded as a + # signature. With it, the comment -- trimmed and lowercased -- + # must be the phrase and nothing else. + custom-pr-sign-comment: 'I have read the CLA Document and I hereby sign the CLA' + custom-notsigned-prcomment: | Thanks for the pull request!