fix(ci): make cla-check work for fork PRs - #325
Merged
Merged
Conversation
The CLA gate relied on a manually POSTed commit status. Fork PRs run workflows with a read-only GITHUB_TOKEN regardless of declared permissions, so the status step always 403s on forks — every external fork PR was permanently red even with a signed CLA. The bot comment step also 403s on forks. - Drop the commit-status step and statuses:write; the gate now rides on this job's own Actions check run (fork-safe by construction). - Comment step becomes same-repo-only + continue-on-error (courtesy, never a gate). Unsigned path emits a ::error annotation with the portal link instead. - github-script upgraded to v9. Validated end-to-end on codecoradev/uteke (PR #1224 + E2E probe).
The if-expression was missing the opening quote before the JSON array inside fromJSON(), which makes the whole workflow unparseable for GitHub Actions. Line now matches the validated uteke@develop file verbatim.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
cla-check.ymlno longer POSTs a commit status (contextCLA Check); the CLA gate now rides on the job's own Actions check run (cla-check)statuses: writepermissioncontinue-on-error(best effort)::errorannotation with the portal linkWhy
Fork PRs always run workflows with a read-only
GITHUB_TOKEN, regardless of declaredpermissions. The old design gated CLA on a manually POSTed commit status, so every external fork PR failed the status step with 403 — permanently red even with a signed CLA. Verified on uteke PR #1221 (fork), run 34481899319:signed='true'yetPOST /statuses -> 403; the comment step was also skipped (forks cannot comment at all).The native Actions check run is created by GitHub itself and is not subject to the fork token restriction, making it the correct carrier for the gate. Semantics unchanged: signed -> green, unsigned -> red with an explanatory annotation. Fix was validated end-to-end on codecoradev/uteke (PR #1224 + E2E probe PR #1225: ruleset swapped to require
cla-check, all checks green, merge CLEAN with an empty combined commit status).Testing
createCommitStatus, nostatuses: write, comment step same-repo-conditioned +continue-on-error,::errorpresent, check-step body byte-identical to the original, trigger untouchedsignatures.json: signed and unsigned paths both correctCLA Check->cla-check(case-sensitive) via API, then the PR is mergeableNotes
Until the ruleset swap, new PRs show a missing
CLA Checkcontext — expected transitional state; this PR itself may show it. Sequence: merge this -> ruleset swap -> mergeable.