fix(cla): store signatures off master, where a bot can write them - #18
Merged
Conversation
CLA Assistant records a signature by committing `signatures/version1/cla.json` directly to the branch it is pointed at. That branch was `master`, which a ruleset covers: every push needs a status check, and a bot commit carries none. So the write was rejected — "Repository rule violations found" — the signature was never stored, the check stayed red, and no outside contribution could be merged. The action's own error says it: the branch where signatures are stored must not be protected. Signatures now live on the unprotected `cla-signatures` branch, which holds that one file and a README explaining why it is off to the side.
Contributor
|
Thank you for your contribution to @imqueue. Before this pull request can be merged, please read the @imqueue Contribution Terms and sign them by posting the following comment exactly: I have read the CLA Document and I hereby sign the CLA You can retrigger this bot by commenting recheck in this Pull Request. Posted by the CLA Assistant Lite bot. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
CLA Assistant records a signature by committing
signatures/version1/cla.jsondirectly to the branch it is pointed at — no pull request, no checks. That branch wasmaster, which a ruleset covers, so the write is rejected:The consequence is not cosmetic: the signature is never stored, the
clacheck stays red for the contributor, and re-signing cannot help. No outside contribution can be merged.Signatures now go to the unprotected
cla-signaturesbranch — an orphan branch holding that one file plus a README saying why it sits off to the side, so nobody later "tidies it up" by protecting it. The existingsignatures/version1/cla.jsonwas copied to that branch verbatim, so recorded signatures carry over unchanged. The copy onmasteris left untouched as a historical record; the action no longer reads it.This PR's own
clacheck will still fail —pull_request_targetruns the workflow from the base branch, so it uses the old config. The fix applies from the first PR opened after this merges.Same change as imqueue/redis-broker#2, rolled across every @imqueue repository with a CLA workflow and a protected default branch.