feat(cli): let every command write its result to a file #241
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CLA | |
| on: | |
| pull_request_target: | |
| types: [opened, reopened, synchronize] | |
| issue_comment: | |
| types: [created, edited, deleted] | |
| concurrency: | |
| group: cla-${{ github.event.pull_request.number || github.event.issue.number || github.run_id }} | |
| # Queue, never cancel. `CONTRIBUTING.md` tells an author to post the acceptance | |
| # sentence on the pull request they just opened, so the comment event reliably | |
| # arrives while the opening event's run is still going. Cancelling that run | |
| # leaves a failed check on a pull request that is in fact fine. | |
| # | |
| # Serializing is also what keeps the result correct: the runs read the head | |
| # commit and the comments live, so the one that finishes last is the one that | |
| # saw the newest state. | |
| cancel-in-progress: false | |
| permissions: | |
| contents: read | |
| issues: read | |
| # Write access is used for exactly one thing: the reminder that tells an author | |
| # how to accept the CLA. Contribution code is never checked out or executed by | |
| # this workflow, so the elevated token never meets untrusted input. | |
| pull-requests: write | |
| statuses: write | |
| jobs: | |
| acceptance-status: | |
| name: Publish CLA status | |
| if: >- | |
| github.event_name == 'pull_request_target' || | |
| (github.event_name == 'issue_comment' && github.event.issue.pull_request) | |
| runs-on: ubuntu-24.04 | |
| timeout-minutes: 5 | |
| steps: | |
| # pull_request_target is used only to read the protected default branch. | |
| # No fork ref or contributor-controlled code is checked out or executed. | |
| - name: Check out the protected CLA verifier | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| ref: ${{ github.event.repository.default_branch }} | |
| persist-credentials: false | |
| - name: Publish the pull-request author's acceptance status | |
| env: | |
| GITHUB_TOKEN: ${{ github.token }} | |
| PR_NUMBER: ${{ github.event.pull_request.number || github.event.issue.number }} | |
| run: | | |
| set -euo pipefail | |
| cla_source_sha="$(git rev-parse HEAD)" | |
| python .github/scripts/check_cla.py \ | |
| --repository "$GITHUB_REPOSITORY" \ | |
| --number "$PR_NUMBER" \ | |
| --cla-sha "$cla_source_sha" \ | |
| --api-url "$GITHUB_API_URL" \ | |
| --remind |