# Gates pull requests on CLA signature using contributor-assistant/github-action.
# Signatures are stored as a JSON file in a separate private repo — do NOT store
# them in this public repo, they contain contributor emails.
#
# Setup before enabling:
#   1. Create a private repo, e.g. projectsend/cla-signatures
#   2. Create a PAT with 'repo' scope that can write to it
#   3. Add it as a secret named PERSONAL_ACCESS_TOKEN in this repository
#
# The two github.com/projectsend/projectsend URLs below are shown to
# contributors when the bot asks them to sign. They must point at a repo an
# outside contributor can actually read.

name: CLA Assistant

on:
  issue_comment:
    types: [created]
  pull_request_target:
    types: [opened, closed, synchronize]

permissions:
  actions: write
  contents: read
  pull-requests: write
  statuses: write

jobs:
  cla:
    # This condition belongs to the job, not to the step below it, and moving
    # it back down would quietly cost money. A step that is skipped has still
    # had a runner allocated for it; a job that is skipped never gets one, and
    # Actions bills per job that runs. `issue_comment` fires on every comment
    # in the repository, so with the check one level lower every "thanks,
    # merged" on a pull request — and every comment on a plain issue — spun up
    # a machine to decide it had nothing to do.
    #
    # GitHub cannot filter `issue_comment` by body at the `on:` level, so this
    # is the only place the decision can be made.
    #
    # `issue.pull_request` is present only when the comment is on a pull
    # request; comments on ordinary issues have nothing for this action to
    # check.
    if: >-
      github.event_name == 'pull_request_target'
      || (github.event.issue.pull_request
          && (github.event.comment.body == 'recheck'
              || github.event.comment.body == 'I have read the CLA Document and I hereby sign the CLA'))
    runs-on: ubuntu-latest
    steps:
      - name: CLA check
        uses: contributor-assistant/github-action@v2.6.1
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          PERSONAL_ACCESS_TOKEN: ${{ secrets.PERSONAL_ACCESS_TOKEN }}
        with:
          path-to-signatures: 'signatures/version1/cla.json'
          path-to-document: 'https://github.com/projectsend/projectsend/blob/main/CLA-INDIVIDUAL.md'
          branch: 'main'
          remote-organization-name: 'projectsend'
          remote-repository-name: 'cla-signatures'

          allowlist: dependabot[bot],renovate[bot],*[bot]

          custom-notsigned-prcomment: |
            Thanks for the pull request!

            Before we can merge it, we need you to sign the Contributor License Agreement.
            It's a one-time thing and takes about a minute — you keep the copyright in your
            contribution, and it lets the project offer commercial licenses that fund
            development of the free version. The reasoning is written out in
            [CONTRIBUTING.md](https://github.com/projectsend/projectsend/blob/main/CONTRIBUTING.md#licensing-and-the-contributor-license-agreement).

            Please read the **[CLA]($pathToCLADocument)**, then post exactly this as a comment
            on this pull request:

          custom-pr-sign-comment: 'I have read the CLA Document and I hereby sign the CLA'
          custom-allsigned-prcomment: 'CLA signed — thanks. A maintainer will review this shortly.'
          lock-pullrequest-aftermerge: false