mirror of
https://github.com/Studio-Saelix/sencho.git
synced 2026-10-27 05:57:40 +00:00
Anso
d13fc14274
After a contributor signs, the action records the signature and then re-runs the PR's failed pull_request_target run so the check turns green. That call needs actions: write, which this workflow withheld, so the run ended with "Resource not accessible by integration" and the check stayed red until the next push. The permission now matches the action's documented sample.
56 lines
2.8 KiB
YAML
56 lines
2.8 KiB
YAML
name: "CLA Assistant"
|
|
on:
|
|
issue_comment:
|
|
types: [created]
|
|
pull_request_target:
|
|
types: [opened,closed,synchronize]
|
|
|
|
# Minimum scopes contributor-assistant/github-action needs to operate:
|
|
# contents: write - commit signatures to the signatures branch
|
|
# pull-requests: write - comment on the PR with the CLA prompt
|
|
# statuses: write - set the commit status (success / pending)
|
|
# actions: write - re-run the PR's failed check after a contributor
|
|
# signs, so the check turns green without another push
|
|
permissions:
|
|
actions: write
|
|
contents: write
|
|
pull-requests: write
|
|
statuses: write
|
|
|
|
jobs:
|
|
CLAAssistant:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- name: "CLA Assistant"
|
|
# Only run on pull_request_target events, or on issue_comment events
|
|
# that are (a) on a PR (not a plain Issue) and (b) match one of the two
|
|
# documented CLA phrases. github.event.issue.pull_request is truthy
|
|
# only when the issue is a PR, so plain-Issue comments are ignored.
|
|
if: |
|
|
github.event_name == 'pull_request_target' ||
|
|
(github.event_name == 'issue_comment' &&
|
|
github.event.issue.pull_request != null &&
|
|
(github.event.comment.body == 'recheck' ||
|
|
github.event.comment.body == 'I have read the CLA Document and I hereby sign the CLA'))
|
|
uses: contributor-assistant/github-action@ca4a40a7d1004f18d9960b404b97e5f30a505a08 # v2.6.1
|
|
env:
|
|
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
|
# The below token is optional but recommended if the CLA signatures should be stored in a private repository or you want to trigger other workflows
|
|
# PERSONAL_ACCESS_TOKEN: ${{ secrets.PERSONAL_ACCESS_TOKEN }}
|
|
with:
|
|
path-to-signatures: 'signatures/version1/cla.json'
|
|
path-to-document: 'https://github.com/studio-saelix/sencho/blob/main/CLA.md'
|
|
# The action commits signatures with the built-in GITHUB_TOKEN, which
|
|
# cannot bypass the main ruleset's "Changes must be made through a pull
|
|
# request" rule. The action requires a branch it can commit to directly,
|
|
# so signatures live on this dedicated branch instead of main. The
|
|
# branch is guarded against deletion and force-pushes, but not against
|
|
# direct commits.
|
|
branch: 'cla-signatures'
|
|
allowlist: 'AnsoCode,dependabot[bot],greenkeeper[bot],github-actions[bot],release-please[bot],sencho-quartermaster[bot]'
|
|
# Default true locks merged PR conversations, which blocks
|
|
# release-please from commenting "included in vX.Y.Z" on the
|
|
# release PR. Signatures live in signatures/version1/cla.json on the
|
|
# cla-signatures branch.
|
|
lock-pullrequest-aftermerge: false
|