From be080bc12ab230750de52f0cf8d5455abee29902 Mon Sep 17 00:00:00 2001 From: Vishal Rana Date: Wed, 21 Oct 2026 10:09:28 -0700 Subject: [PATCH] chore: adopt the shared LabStack CLA and enforce it --- .github/workflows/cla.yml | 39 +++++++++++++++++++++++++++++++++++++++ CLA.md | 30 ++++++++++++++++++------------ 2 files changed, 57 insertions(+), 12 deletions(-) create mode 100644 .github/workflows/cla.yml diff --git a/.github/workflows/cla.yml b/.github/workflows/cla.yml new file mode 100644 index 00000000..24eb4f46 --- /dev/null +++ b/.github/workflows/cla.yml @@ -0,0 +1,39 @@ +name: CLA + +on: + issue_comment: + types: [created] + pull_request_target: + types: [opened, synchronize, reopened] + +permissions: + actions: write + # write, not read: the action commits each signature to the branch below. + contents: write + pull-requests: write + statuses: write + +jobs: + cla: + name: Check CLA + runs-on: ubuntu-24.04 + # Only react to the signature sentence, or to pull request events. Note this + # workflow never checks out pull request code: `pull_request_target` runs + # with a writable token in the base repository context, so running a + # contributor's code here would hand them that token. + if: >- + github.event_name == 'pull_request_target' || + (github.event.issue.pull_request != null && + github.event.comment.body == 'I have read the CLA Document and I hereby sign the CLA') + steps: + - uses: contributor-assistant/github-action@ca4a40a7d1004f18d9960b404b97e5f30a505a08 # v2.6.1 + env: + GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} + with: + path-to-document: https://github.com/labstack/onebox/blob/main/CLA.md + path-to-signatures: signatures.json + # Signatures live on their own branch. Storing them on main would put + # a bot commit into the release history and trigger a CI run every + # time somebody signs. + branch: cla-signatures + allowlist: vishr,dependabot[bot] diff --git a/CLA.md b/CLA.md index 2f941889..573be135 100644 --- a/CLA.md +++ b/CLA.md @@ -1,12 +1,13 @@ -# Onebox Contributor License Agreement +# LabStack Contributor License Agreement -Thank you for your interest in contributing to Onebox, a project of LabStack -LLC ("LabStack", "we", "us"). +Thank you for your interest in contributing to a project of LabStack LLC +("LabStack", "we", "us"), such as Driga, Fanout, or Onebox. This Contributor License Agreement ("Agreement") documents the rights granted by contributors to LabStack. It applies to any Contribution you submit to any project owned or managed by LabStack. Signing it is a one-time step; it covers -all of your future Contributions to Onebox unless you notify us otherwise. +all of your future Contributions to LabStack projects unless you notify us +otherwise. **You keep the copyright in your Contribution.** This Agreement is a license, not an assignment. You may continue to use your Contribution however you wish, @@ -63,12 +64,12 @@ terms, including licenses other than the Apache License, Version 2.0, and to distribute Your Contribution as part of proprietary or commercially licensed offerings. -This clause exists so that Onebox can offer a commercially licensed edition -without needing to locate and re-negotiate with every past contributor. It does -not restrict Your own use of Your Contribution, and it does not withdraw any -release already made under an open source license: every version of Onebox -published under the Apache License, Version 2.0, remains available under that -license permanently. +This clause exists so that a LabStack project can offer a commercially +licensed edition without needing to locate and re-negotiate with every past +contributor. It does not restrict Your own use of Your Contribution, and it +does not withdraw any release already made under an open source license: every +version of a LabStack project published under the Apache License, Version 2.0, +remains available under that license permanently. ## 5. Your representations @@ -102,8 +103,13 @@ aware that would make these representations inaccurate in any respect. ## How to sign Open a pull request. An automated check will ask you to accept this Agreement -by leaving a comment on the pull request; the check records your acceptance -against your account, and future pull requests will not ask again. +by commenting on the pull request with: + +> I have read the CLA Document and I hereby sign the CLA + +The check records your acceptance against your account, and future pull +requests to that repository will not ask again. The Agreement covers every +LabStack project, but each repository's check may ask once. If you are contributing on behalf of a legal entity that requires a countersigned document, email before opening the pull