From 7c18d53e2cbd22e15fa95f6f0acd159af6a5ebff Mon Sep 17 00:00:00 2001 From: Alexis Rolland Date: Mon, 29 Jun 2026 15:24:17 +0800 Subject: [PATCH] Refactor CLA workflow configuration Updated CLA workflow to modify permissions and action version. --- .github/workflows/cla.yml | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/.github/workflows/cla.yml b/.github/workflows/cla.yml index 330c1e189..6d38de4ed 100644 --- a/.github/workflows/cla.yml +++ b/.github/workflows/cla.yml @@ -5,10 +5,11 @@ on: types: [created] pull_request_target: types: [opened, synchronize, closed] + merge_group: permissions: actions: write - contents: read # 'read' is enough because signatures live in a REMOTE repo + contents: read # 'read' is enough because signatures live in a REMOTE repo pull-requests: write statuses: write @@ -23,7 +24,7 @@ jobs: github.event_name == 'pull_request_target' || github.event.comment.body == 'recheck' || github.event.comment.body == 'I have read and agree to the Contributor License Agreement' - uses: contributor-assistant/github-action@v2.6.1 + uses: contributor-assistant/github-action@ca4a40a7d1004f18d9960b404b97e5f30a505a08 # v2.6.1 env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} # PAT required to write to the centralized signatures repo. @@ -40,7 +41,7 @@ jobs: # Allowlist bots so they don't need to sign (optional, comma-separated). # *[bot] is a catch-all for any GitHub App bot account. - allowlist: ampagent,claude,coderabbitai[bot],comfy-pr-bot,dependabot[bot],github-actions[bot],copilot-swe-agent[bot],devin-ai-integration[bot],*[bot] + allowlist: action@github.com,actions-user,ampagent,claude,comfy-pr-bot,GitHub Action,github-actions,Glary Bot,Glary-Bot,*[bot] # Custom PR comment messages custom-notsigned-prcomment: |