From 7059a932411b9788725caae50be71a1229d7ce69 Mon Sep 17 00:00:00 2001 From: IAmBod Date: Thu, 20 Aug 2026 14:46:59 +0200 Subject: [PATCH] fix(ci): keep the CLA job inert until CLA_SIGNATURES_TOKEN is set MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The CLA workflow landed with #211 before its prerequisite secret existed, so the "CLA Assistant" check failed on every pull request — the action cannot write the signature file without the token. With no branch protection requiring the check, that is noise rather than a gate. Guard the step on the token being present. The secrets context is not available in an if expression, so the secret is lifted to a job-level env var, which is. Once the secret is added the job starts working with no further change. Co-Authored-By: Claude Opus 5 (1M context) Claude-Session: https://claude.ai/code/session_015aZ5qHYBsde5ysgUrRmbwD --- .github/workflows/cla.yml | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-) diff --git a/.github/workflows/cla.yml b/.github/workflows/cla.yml index c8a9d55..29f5b12 100644 --- a/.github/workflows/cla.yml +++ b/.github/workflows/cla.yml @@ -30,12 +30,20 @@ jobs: cla: name: CLA Assistant runs-on: ubuntu-latest + # Lifted to job level so the step's `if` can test it: the `secrets` context is not + # available in an `if` expression, but `env` is. + env: + CLA_SIGNATURES_TOKEN: ${{ secrets.CLA_SIGNATURES_TOKEN }} steps: - name: Check or record CLA signature + # Stays inert until CLA_SIGNATURES_TOKEN exists: without it the action cannot + # write the signature file and fails every pull request, which — with no branch + # protection requiring this check — is pure noise rather than a gate. if: >- - github.event_name == 'pull_request_target' || + env.CLA_SIGNATURES_TOKEN != '' && + (github.event_name == 'pull_request_target' || github.event.comment.body == 'recheck' || - github.event.comment.body == 'I have read the CLA Document and I hereby sign the CLA' + github.event.comment.body == 'I have read the CLA Document and I hereby sign the CLA') uses: contributor-assistant/github-action@v2.6.1 env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}