Streamline your workflow and let this GitHub Action(a lite version of CLA Assistant) handle the legal side of contributions to a repository for you. CLA assistant enables contributors to sign CLAs from within a pull request. With this GitHub Action we get rid of the need for a centrally managed database by storing the contributor's signature data in a decentralized way - in the repository's file system
- decentralized data storage
- fully integrated with github environment
- no UI required
- no need for permission/scope handling
- contributors can sign the CLA by just posting a Pull Request comment
- signatures will be stored in a file inside the repository plus optionally on the Ethereum Blockchain
name: "CLA Assistant"
on:
issue_comment:
types: [created]
pull_request:
types: [opened,closed,synchronize]
jobs:
CLAssistant:
runs-on: ubuntu-latest
steps:
- name: "CLA Assistant"
if: (github.event.comment.body == 'recheckcla' || github.event.comment.body == 'I have read the CLA Document and I hereby sign the CLA') || github.event_name == 'pull_request'
# Alpha Release
uses: cla-assistant/github-action@v1.4.2-alpha
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
with:
path-to-signatures: 'signatures/version1/cla.json'
path-to-cla-document: 'https://github.com/cla-assistant/github-action/blob/master/SAPCLA.md'
# branch should not be protected
branch: 'master'
allowlist: user1,user2,bot*
empty-commit-flag: false
blockchain-storage-flag: false
CLA action workflow will be triggered on all Pull Request opened, synchronize, closed.
When the CLA workflow is triggered on pull request closed event, it will lock the Pull Request conversation after the Pull Request merge so that the contributors cannot modify or delete the signatures (Pull Request comment) later. This feature is optional.
CLA workflow creates a comment on Pull Request asking contributors who have not signed CLA to sign and also fails the pull request status check with a failure. The contributors are requested to sign the CLA within the pull request by copy and pasting "I have read the CLA Document and I hereby sign the CLA" as a Pull Request comment like below.
If the contributor has already signed the CLA, then the PR status will pass with success.
By default, this Action workflow will also create an empty commit with a message "@#contributorname# has signed the CLA" whenever a contributor signs the CLA.
After the contributor signed a CLA, the contributor's signature with metadata will be stored in a JSON file inside the repository like below screenshot and you can specify the custom path to this file with path-to-signatures input in the workflow.
The default path is path-to-signatures: 'signatures/version1/cla.json'
If a GitHub username is included in the allowlist, they will not be required to sign a CLA. You can make use of this feature If you don't want your colleagues working in the same team/organisation to sign a CLA. And also, since there's no way for bot users (such as Dependabot or Greenkeeper) to sign a CLA, you may want to add them in allowlist. You can do so by adding their names in a comma separated string to the allowlist input in the CLA workflow file(in this case dependabot-preview[bot],greenkeeper[bot]). You can also use wildcard symbol in case you want to allow all bot users something like bot*.
To make the whole process more fraud resistant we grant the option to additionally store the signatures on the Ethereum Blockchain. To use this feature just set the blockchain-storage-flag: true. A detailed description on integrating with the Ethereum Blockchain can be found here - special credits and thanks goes to @FabianRiewe.
| Name | Requirement | Description |
|---|---|---|
GITHUB_TOKEN |
required | Must be in the form of GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} , CLA Action uses this in-built GitHub token to make the API calls for interacting with GitHub. It is built into Github Actions and does not need to be manually specified in your secrets store. More Info |
| Name | Requirement | Description |
|---|---|---|
path-to-cla-document |
required | provide full URL https://<clafile> to the Contributor License Agreement (CLA) to which the Contributor can read before signing the CLA. It can be a file inside the repository or it can be a gist |
path-to-signatures |
optional | Path to the JSON file where all the signatures of the contributors will be stored inside the repository. Default path is "./signatures/cla.json". |
branch |
optional | Branch in which all the signatures of the contributors will be stored and Default branch is master |
empty-commit-flag |
optional | provide the boolean true or false so that GitHub Actions will add empty commit whenever user signs the CLA. Default is true |
allowlist |
optional | You can specify users and bots to be added in allowlist. For example user1,user2,bot* |
blockchain-storage-flag |
optional | provide the boolean true or false to optionally store the Contributor's signature data in the Ethereum blockchain. Default is false |
This action won't work for Pull Request coming from the forks as the GitHub Action Token does not have write access for the forks, However, the GitHub team assured in one of the discussion that they will ship this feature to enable read/write access for the PRs coming from the forks.
Contributor License Agreement assistant
Copyright (c) 2020 SAP SE or an SAP affiliate company. All rights reserved.
Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at
http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License.
❤️ from the GitHub team @SAP