Skip to content

Contributor License Agreement, signed once per contributor on their pull request - #65

Draft
0b3l1X-SolidGeeks wants to merge 2 commits into
mainfrom
claude/stoic-mendel-mqa2h2
Draft

0b3l1X-SolidGeeks wants to merge 2 commits into
mainfrom
claude/stoic-mendel-mqa2h2

Conversation

@0b3l1X-SolidGeeks

@0b3l1X-SolidGeeks 0b3l1X-SolidGeeks commented Oct 31, 2026 •

Copy link
Copy Markdown
Member

What this changes

Contributions to Strata now need a Contributor License Agreement (CLA.md), signed once with a comment on the contributor's first pull request. Contributors keep their copyright and still license their work to everyone under the AGPL; the maintainer may also distribute it under other licences, commercial ones included, so Strata can be offered under a commercial licence next to the AGPL. Versions already published (0.1 to 0.10) stay under the AGPL.

  • CLA.md: the agreement (copyright and patent licence, the contributor confirms the work is theirs to give, including towards an employer; French law).
  • .github/workflows/cla.yml: contributor-assistant/github-action v2.6.1, pinned by SHA. It runs on pull_request_target and never checks out the pull request's code. Signatures go to signatures/cla.json on a cla-signatures branch, out of main's history. The maintainer's accounts, Claude's commits and the bots are allowlisted.
  • README: the licence paragraph and the contribution rules mention the CLA. The DCO sign-off stays.

Draft until a lawyer has reviewed CLA.md.

How to check it

  1. Create the cla-signatures branch from main before merging.
  2. After merging, open a test pull request from an account outside the allowlist: the bot asks for the signature; comment I have read the CLA Document and I hereby sign the CLA and the check turns green, with the signature recorded on cla-signatures.
  3. The workflow only runs from main (pull_request_target), so it does not run on this pull request.

Outside this repository: SolidGeeks/.github (CONTRIBUTING.md says "no CLA", the pull request template mentions only the DCO) needs the same change.

The Solid checklist

  • Tests cover the change and pass in CI (no code change; the workflow is checked by the test pull request above)
  • Docs are updated (README)
  • No secrets, keys or personal data in the diff
  • Every commit is signed off (the first commit lacks the sign-off; the second has it)
  • New files carry the repo's SPDX license header (none needed: Markdown and workflows carry none in this repository)

Generated by Claude Code

…ull request

Contributions to Strata now need the CLA (CLA.md), signed with a comment on the
first pull request. Contributors keep their copyright and still license their
work to everyone under the AGPL; the maintainer may also distribute it under
other licences, commercial ones included, so Strata can be offered under a
commercial licence next to the AGPL.

The CLA workflow uses contributor-assistant/github-action (pinned by SHA) and
keeps signatures on the cla-signatures branch, out of main's history. It runs
on pull_request_target without checking out the pull request's code. The
maintainer's accounts and the bots are allowlisted. The README says so next to
the licence and in the contribution rules; the DCO sign-off stays as it is.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01BvKC5Y1p67gShNKLeeWi4Y
Claude's commits are not tied to a GitHub account, so the CLA check could
not match them to a signature. They are the maintainer's work: allowlist them
with the maintainer's accounts.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01BvKC5Y1p67gShNKLeeWi4Y
Signed-off-by: Claude <noreply@anthropic.com>

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants