chore: migrate to CLA Assistant GitHub Action #573
Conversation
- Replace custom CLA system with contributor-assistant/github-action - Add all 25 existing signers to allowlist (no re-signing needed) - Remove old cla-check.yml workflow and cla_check.py script - Remove old cla-signers.json and issue template - New contributors sign by commenting on their PR - Signatures stored in signatures/cla.json (auto-created) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
📝 WalkthroughWalkthroughRemoves the repository's custom CLA infrastructure (issue template, signer manifest, Python verifier, and workflow) and adds a new GitHub Actions workflow using contributor-assistant/github-action@v2 to manage CLA signing and store signatures. Changes
Sequence Diagram(s)sequenceDiagram
participant Contributor
participant GitHub as GitHub (PR)
participant Action as CLA Assistant Action
participant Repo as Repository (signatures/cla.json)
participant Comment as PR Comments
Contributor->>GitHub: Open PR or post signed comment
GitHub->>Action: Trigger workflow (pull_request_target / issue_comment)
Action->>Repo: Read/Write signatures/cla.json
Action->>Comment: Post/update signing status and instructions
Action->>GitHub: Optionally lock PR after merge
Comment->>Contributor: Inform about signing status
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~25 minutes Possibly related PRs
Suggested reviewers
Poem
🚥 Pre-merge checks | ✅ 2 | ❌ 1❌ Failed checks (1 inconclusive)
✅ Passed checks (2 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. 📜 Recent review detailsConfiguration used: defaults Review profile: CHILL Plan: Pro 📒 Files selected for processing (2)
💤 Files with no reviewable changes (1)
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (4)
🔇 Additional comments (1)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Summary of ChangesHello @Anshgrover23, I'm Gemini Code Assist1! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed! This pull request modernizes the project's Contributor License Agreement (CLA) process by transitioning from a bespoke Python-based system to the Highlights
Ignored Files
Using Gemini Code AssistThe full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips. Invoking Gemini You can request assistance from Gemini at any point by creating a comment using either
Customization To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a Limitations & Feedback Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for Github and other Google products, sign up here. You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension. Footnotes
|
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request is a great improvement, migrating from a custom CLA verification system to the standard contributor-assistant/github-action. This simplifies the repository by removing a significant amount of custom code. While the deletions are correct, this change introduces one issue: the CONTRIBUTING.md file is now outdated and will confuse new contributors. Please see the detailed comments for suggestions.
I am having trouble creating individual review comments. Click here to see my feedback.
.github/ISSUE_TEMPLATE/cla-signature.yml (1-87)
The deletion of this issue template makes the instructions in CONTRIBUTING.md outdated. The contributing guide still directs new contributors to use this template to sign the CLA. This will lead to confusion and a broken workflow for new contributors. Please update CONTRIBUTING.md to describe the new signing process, which involves posting a specific comment on the pull request.
- Update CONTRIBUTING.md with new sign-by-comment flow - Remove "For Maintainers" section (no longer needed) - Delete CLA_BADGE.md (referenced hosted service we don't use) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 0
🧹 Nitpick comments (1)
.github/workflows/cla.yml (1)
24-24: Pin to a specific commit SHA for supply chain security.Using
@v2tracks the latest v2.x release, which is convenient but introduces supply chain risk. GitHub's security best practices recommend pinning to a full commit SHA for immutability, as tag references can be moved or compromised.🔒 Proposed fix to pin to specific SHA
- uses: contributor-assistant/github-action@v2 + uses: contributor-assistant/github-action@<full-commit-sha> # See releases page for SHAFind the latest release SHA from the action's releases page. The current latest version is v2.6.1.
📜 Review details
Configuration used: defaults
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (5)
.github/ISSUE_TEMPLATE/cla-signature.yml.github/cla-signers.json.github/scripts/cla_check.py.github/workflows/cla-check.yml.github/workflows/cla.yml
💤 Files with no reviewable changes (4)
- .github/ISSUE_TEMPLATE/cla-signature.yml
- .github/cla-signers.json
- .github/workflows/cla-check.yml
- .github/scripts/cla_check.py
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (5)
- GitHub Check: Test (Python 3.12)
- GitHub Check: Test (Python 3.11)
- GitHub Check: test (3.12)
- GitHub Check: test (3.10)
- GitHub Check: test (3.11)
🔇 Additional comments (3)
.github/workflows/cla.yml (3)
1-6: LGTM - Appropriate use ofpull_request_target.Using
pull_request_targetis the correct choice here since:
- It provides write access and secrets for forked PRs
- The CLA action doesn't check out or execute untrusted code from the PR branch
The trigger types cover all necessary events for CLA management.
8-12: Permissions are appropriately scoped.Each permission serves a specific purpose:
contents: write→ commit signatures tosignatures/cla.jsonpull-requests: write→ post CLA prompts/confirmationsstatuses: write→ update PR check status
25-50: Configuration is well-structured.Good practices observed:
lock-pullrequest-aftermerge: trueprevents post-merge tampering- Bot accounts properly excluded from CLA requirement
- Custom messages provide clear guidance for new contributors
- Allowlist includes all 25 existing signers from the old system
|
1 participant
Summary
contributor-assistant/github-actionsignatures/cla.json(auto-created)Changes
.github/workflows/cla-check.yml.github/workflows/cla.yml.github/scripts/cla_check.py(390 lines).github/cla-signers.json.github/ISSUE_TEMPLATE/cla-signature.ymlResult: 814 lines removed, 50 lines added
New Contributor Flow
signatures/cla.jsonautomaticallyExisting Signers
All 25 existing signers are in the allowlist - they don't need to re-sign:
Test plan
🤖 Generated with Claude Code
Summary by CodeRabbit
Chores
Documentation
✏️ Tip: You can customize this high-level summary in your review settings.