From 9816d6eba744a9fd226ec8d4adb218dd695b65a9 Mon Sep 17 00:00:00 2001 From: Enrico Piovesan Date: Tue, 7 Jul 2026 08:25:22 -0600 Subject: [PATCH] Governance v1.0.2: CLA gate resilience and agent-identity allowlist - Degrade gracefully while CLA_ASSISTANT_PAT is unset: allowlisted authors pass with a warning; external authors still fail closed. - Allowlist the owner's coding-agent identities (claude, cursoragent) and the owner's unlinked machine-local git identity. Co-Authored-By: Claude Fable 5 --- .github/workflows/reusable-cla.yml | 30 +++++++++++++++++++++++++++++- CHANGELOG.md | 7 +++++++ 2 files changed, 36 insertions(+), 1 deletion(-) diff --git a/.github/workflows/reusable-cla.yml b/.github/workflows/reusable-cla.yml index 314b736..d04f11b 100644 --- a/.github/workflows/reusable-cla.yml +++ b/.github/workflows/reusable-cla.yml @@ -29,7 +29,33 @@ jobs: github.event.comment.body == 'I have read the CLA Document and I hereby sign the CLA' || github.event_name == 'pull_request_target' steps: + # Without the PAT the CLA action cannot even read signatures and fails + # for everyone. Degrade gracefully: allowlisted authors (owner + bots, + # who never need to sign) pass with a warning; everyone else still + # fails closed so no unsigned external contribution can merge. + - name: Check CLA storage configuration + id: cfg + env: + PAT: ${{ secrets.cla-assistant-pat }} + AUTHOR: ${{ github.event.pull_request.user.login || github.event.comment.user.login || github.actor }} + run: | + if [ -n "$PAT" ]; then + echo "mode=enforce" >> "$GITHUB_OUTPUT" + exit 0 + fi + case "$AUTHOR" in + enricopiovesan|*"[bot]") + echo "::warning::CLA_ASSISTANT_PAT is not configured (see docs/owner-setup.md); author '$AUTHOR' is allowlisted so this check passes. External contributors fail closed until the secret is set." + echo "mode=allowlisted-pass" >> "$GITHUB_OUTPUT" + ;; + *) + echo "::error::CLA gate cannot record signatures: the CLA_ASSISTANT_PAT secret is not configured (see docs/owner-setup.md in traverse-framework/.github). Failing closed for author '$AUTHOR'." + exit 1 + ;; + esac + - name: CLA assistant + if: steps.cfg.outputs.mode == 'enforce' uses: contributor-assistant/github-action@v2.6.1 env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} @@ -40,5 +66,7 @@ jobs: branch: cla-signatures path-to-signatures: signatures/version1/cla.json path-to-document: https://github.com/traverse-framework/.github/blob/HEAD/CLA.md - allowlist: enricopiovesan,*[bot] + # claude / cursoragent / "Enrico Piovesan" are the owner's coding + # agents and the owner's unlinked machine-local git identity. + allowlist: enricopiovesan,claude,cursoragent,Enrico Piovesan,*[bot] lock-pullrequest-aftermerge: false diff --git a/CHANGELOG.md b/CHANGELOG.md index 07a516f..7c9ff3d 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -4,6 +4,13 @@ All notable changes to the org-wide governance in this repository are documented The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and versions follow [Semantic Versioning](https://semver.org/): a **major** bump means a rule change that can newly block merges in consuming repos; **minor** adds rules or tooling that are backwards-compatible; **patch** is clarification only. +## [1.0.2] - 2026-07-07 + +### Fixed + +- CLA gate degrades gracefully while `CLA_ASSISTANT_PAT` is unset: allowlisted authors (owner and `*[bot]`) pass with a warning instead of everyone failing at action startup; non-allowlisted authors still fail closed. With `cla / cla` now a required check org-wide, the previous behavior blocked every PR including the owner's and Dependabot's. +- CLA allowlist covers the owner's coding-agent identities (`claude`, `cursoragent`, and the owner's unlinked local git identity) so agent-authored PRs aren't asked to sign the owner's own CLA. + ## [1.0.1] - 2026-07-06 ### Fixed