From 33080d4f760e87398365f7bdaf8186273ff22005 Mon Sep 17 00:00:00 2001 From: Mykhailo Stadnyk Date: Tue, 8 Sep 2026 21:07:07 +0200 Subject: [PATCH] fix(cla): store signatures off master, where a bot can write them MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit CLA Assistant records a signature by committing `signatures/version1/cla.json` directly to the branch it is pointed at. That branch was `master`, which a ruleset covers: every push needs a status check, and a bot commit carries none. So the write was rejected — "Repository rule violations found" — the signature was never stored, the check stayed red, and no outside contribution could be merged. The action's own error says it: the branch where signatures are stored must not be protected. Signatures now live on the unprotected `cla-signatures` branch, which holds that one file and a README explaining why it is off to the side. --- .github/workflows/cla.yml | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/.github/workflows/cla.yml b/.github/workflows/cla.yml index 4fdcb29..67a1722 100644 --- a/.github/workflows/cla.yml +++ b/.github/workflows/cla.yml @@ -27,7 +27,12 @@ jobs: with: path-to-signatures: 'signatures/version1/cla.json' path-to-document: 'https://github.com/imqueue/.github/blob/master/CONTRIBUTION-TERMS.md' - branch: 'master' + # NOT master, and not any branch that gains a ruleset later. The + # bot writes this file with a direct commit, which cannot satisfy the + # status check the default branch requires — every signature failed + # to record, so no outside contribution could be merged. The branch + # holds the signature file and nothing else. + branch: 'cla-signatures' allowlist: 'dependabot[bot],*[bot]' custom-notsigned-prcomment: >- Thank you for your contribution to **@imqueue**. Before this pull