mirror of
https://github.com/projectsend/projectsend.git
synced 2026-09-23 20:06:20 +00:00
ignacionelson
86edbc640d
c9a4b552added custom-pr-sign-comment to close a hole that was not there: the key was already set further down the same block, with the same value, and has been since 2.0.0. The action was already comparing the whole comment, so a comment wrapping the phrase in other text was never recorded as a signature, and loosening the job filter in0a7330d5opened nothing. The second copy made the file invalid, and GitHub stopped running the CLA check at all. This removes the copy and says at the original why it is set, since it repeats the action's default phrase and looks removable.
93 lines
4.3 KiB
YAML
93 lines
4.3 KiB
YAML
# Gates pull requests on CLA signature using contributor-assistant/github-action.
|
|
# Signatures are stored as a JSON file in a separate private repo — do NOT store
|
|
# them in this public repo, they contain contributor emails.
|
|
#
|
|
# Setup before enabling:
|
|
# 1. Create a private repo, e.g. projectsend/cla-signatures
|
|
# 2. Create a PAT with 'repo' scope that can write to it
|
|
# 3. Add it as a secret named PERSONAL_ACCESS_TOKEN in this repository
|
|
#
|
|
# The two github.com/projectsend/projectsend URLs below are shown to
|
|
# contributors when the bot asks them to sign. They must point at a repo an
|
|
# outside contributor can actually read.
|
|
|
|
name: CLA Assistant
|
|
|
|
on:
|
|
issue_comment:
|
|
types: [created]
|
|
pull_request_target:
|
|
types: [opened, closed, synchronize]
|
|
|
|
permissions:
|
|
actions: write
|
|
contents: read
|
|
pull-requests: write
|
|
statuses: write
|
|
|
|
jobs:
|
|
cla:
|
|
# This condition belongs to the job, not to the step below it, and moving
|
|
# it back down would quietly cost money. A step that is skipped has still
|
|
# had a runner allocated for it; a job that is skipped never gets one, and
|
|
# Actions bills per job that runs. `issue_comment` fires on every comment
|
|
# in the repository, so with the check one level lower every "thanks,
|
|
# merged" on a pull request — and every comment on a plain issue — spun up
|
|
# a machine to decide it had nothing to do.
|
|
#
|
|
# GitHub cannot filter `issue_comment` by body at the `on:` level, so this
|
|
# is the only place the decision can be made.
|
|
#
|
|
# `issue.pull_request` is present only when the comment is on a pull
|
|
# request; comments on ordinary issues have nothing for this action to
|
|
# check.
|
|
#
|
|
# Loose on purpose, never `==`. This only decides whether a runner
|
|
# starts; whether a comment is a signature is decided by the action,
|
|
# strictly, against `custom-pr-sign-comment` below. An exact match here
|
|
# threw away a real signature that arrived with trailing line breaks
|
|
# ("...sign the CLA\r\n\r\n"), which the action -- it trims first --
|
|
# would have accepted. `contains` and `startsWith` ignore case.
|
|
if: >-
|
|
github.event_name == 'pull_request_target'
|
|
|| (github.event.issue.pull_request
|
|
&& (startsWith(github.event.comment.body, 'recheck')
|
|
|| contains(github.event.comment.body, 'I have read the CLA Document and I hereby sign the CLA')))
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- name: CLA check
|
|
uses: contributor-assistant/github-action@v2.6.1
|
|
env:
|
|
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
|
PERSONAL_ACCESS_TOKEN: ${{ secrets.PERSONAL_ACCESS_TOKEN }}
|
|
with:
|
|
path-to-signatures: 'signatures/version1/cla.json'
|
|
path-to-document: 'https://github.com/projectsend/projectsend/blob/main/CLA-INDIVIDUAL.md'
|
|
branch: 'main'
|
|
remote-organization-name: 'projectsend'
|
|
remote-repository-name: 'cla-signatures'
|
|
|
|
allowlist: dependabot[bot],renovate[bot],*[bot]
|
|
|
|
custom-notsigned-prcomment: |
|
|
Thanks for the pull request!
|
|
|
|
Before we can merge it, we need you to sign the Contributor License Agreement.
|
|
It's a one-time thing and takes about a minute — you keep the copyright in your
|
|
contribution, and it lets the project offer commercial licenses that fund
|
|
development of the free version. The reasoning is written out in
|
|
[CONTRIBUTING.md](https://github.com/projectsend/projectsend/blob/main/CONTRIBUTING.md#licensing-and-the-contributor-license-agreement).
|
|
|
|
Please read the **[CLA]($pathToCLADocument)**, then post exactly this as a comment
|
|
on this pull request:
|
|
|
|
# Not decoration, although it repeats the action's default phrase.
|
|
# Set, it makes the action compare the whole comment, trimmed and
|
|
# lowercased, against it. Unset, the action searches the comment
|
|
# for the phrase instead, and "I LIE, I have read the CLA Document
|
|
# and I hereby sign the CLA. I do not sign it" on one line would
|
|
# be recorded as a signature.
|
|
custom-pr-sign-comment: 'I have read the CLA Document and I hereby sign the CLA'
|
|
custom-allsigned-prcomment: 'CLA signed — thanks. A maintainer will review this shortly.'
|
|
lock-pullrequest-aftermerge: false
|