Contributor License Agreement, signed once per contributor on their pull request

.github/workflows/cla.yml

@@ -0,0 +1,37 @@
+# Contributor License Agreement (CLA.md): each author of a pull request signs it once, with a comment on
+# the pull request. Signatures are kept in signatures/cla.json on the cla-signatures branch (create it from
+# main once; it stays out of main's history). pull_request_target runs with this repository's token, so this
+# workflow never checks out or runs the pull request's code.
+name: CLA
+
+on:
+  issue_comment:
+    types: [created]
+  pull_request_target:
+    types: [opened, reopened, synchronize, closed]
+
+permissions:
+  actions: write
+  contents: write
+  pull-requests: write
+  statuses: write
+
+jobs:
+  cla:
+    if: >-
+      github.event_name == 'pull_request_target' ||
+      (github.event.issue.pull_request &&
+        (github.event.comment.body == 'recheck' ||
+         github.event.comment.body == 'I have read the CLA Document and I hereby sign the CLA'))
+    runs-on: ubuntu-latest
+    steps:
+      - uses: contributor-assistant/github-action@ca4a40a7d1004f18d9960b404b97e5f30a505a08 # v2.6.1
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        with:
+          path-to-document: https://github.com/SolidGeeks/strata/blob/main/CLA.md
+          path-to-signatures: signatures/cla.json
+          branch: cla-signatures
+          # the maintainer's accounts, the commits Claude writes for the maintainer, and the bots: no signature needed
+          allowlist: 0b3l1X,0b3l1X-SolidGeeks,Claude,dependabot[bot],github-actions[bot]
+          lock-pullrequest-aftermerge: false

CLA.md

@@ -0,0 +1,57 @@
+<!-- Draft: have a lawyer review this agreement before it is merged and used. -->
+# Strata Contributor License Agreement
+
+Version 1.0
+
+Thank you for contributing to Strata. Before your first pull request can be merged, we ask you to accept this agreement once, by a comment on the pull request (see *How to sign* at the end).
+
+**In short:**
+
+- You keep the copyright of your contribution.
+- You give the Maintainer a broad licence to use it, including the right to distribute it under licences other than the GNU AGPL, commercial ones included. This is what allows Strata to be offered under a commercial licence next to the AGPL, and its maintenance to be funded.
+- Your contribution is also licensed to everyone under the AGPL, like the rest of this repository.
+- You confirm that the contribution is yours to give.
+
+## 1. Definitions
+
+- **You**: the person who submits a Contribution and accepts this agreement.
+- **Maintainer**: the holder of the copyright in Strata who manages the `SolidGeeks/strata` repository, currently the owner of the SolidGeeks GitHub organization, and any successor or assignee of the rights in Strata, including a company created to develop it.
+- **Contribution**: any original work of authorship (code, documentation, translation, design, test, data) that You submit to the Maintainer for inclusion in Strata, through a pull request, a patch, an issue or any other means, unless You mark it in writing as "Not a Contribution" when You submit it.
+- **Submit**: send in any form to the Maintainer or to the Strata repositories, issue trackers and discussions.
+
+## 2. Copyright licence
+
+You grant the Maintainer a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable licence to reproduce, adapt, prepare derivative works of, publicly display, publicly perform, sublicense and distribute Your Contributions and such derivative works, under any licence terms the Maintainer chooses, including the GNU Affero General Public License, other open source licences and proprietary commercial licences.
+
+You also license Your Contributions to everyone under the GNU Affero General Public License, version 3 or (at their option) any later version, like the rest of the repository.
+
+## 3. Patent licence
+
+You grant the Maintainer, and everyone who receives Strata from the Maintainer, a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable patent licence to make, have made, use, offer to sell, sell, import and otherwise transfer Your Contributions, alone or combined with Strata. This licence covers only the patent claims You can license that are necessarily infringed by Your Contribution alone or by its combination with Strata. If anyone starts patent litigation alleging that Your Contribution or Strata infringes a patent, the patent licences granted to them under this agreement end on the date the litigation is filed.
+
+## 4. What You confirm
+
+1. Each Contribution is Your original creation, and You are legally entitled to grant the licences above.
+2. If Your employer, a client or anyone else has rights in what You create (through Your employment contract, a services contract or the law), You have their permission to submit the Contribution under this agreement, or they have waived those rights.
+3. If a Contribution includes work that is not Yours, You say so when You submit it, with its origin and its licence.
+4. You will tell the Maintainer if any of the above stops being true.
+
+## 5. Moral rights
+
+To the extent the applicable law allows, You agree not to assert Your moral rights in a Contribution against uses that this agreement permits.
+
+## 6. No obligation, no warranty
+
+The Maintainer is not required to use or merge any Contribution. Unless You agree otherwise in writing, You provide Your Contributions "as is", without warranties or conditions of any kind, and You are not expected to provide support for them.
+
+## 7. Applicable law
+
+This agreement is governed by French law.
+
+## How to sign
+
+When You open your first pull request, a bot asks You to sign. Read this agreement, then reply on the pull request with this exact comment:
+
+> I have read the CLA Document and I hereby sign the CLA
+
+The bot records Your GitHub username, the date and the pull request in `signatures/cla.json`, on the `cla-signatures` branch of this repository. You sign once; it covers all Your later Contributions. If the check does not update, comment `recheck`.

README.md

@@ -98,7 +98,7 @@ Four-eyes rule: a proposal from a Palo Alto **file** counts as the proposal of t
 
 `CONNECTORS=false` in `.env` turns the connectors off completely.
 
-**License:** Strata is free software under the [GNU AGPL v3](LICENSE). You can use it, modify it and redistribute it; if you make a **modified** version available to users over a network, you must give them access to its source code. The *Source code* link at the bottom of the control panel points to `SOURCE_URL` (in `.env`): point it at your fork if you modify the code.
+**License:** Strata is free software under the [GNU AGPL v3](LICENSE). You can use it, modify it and redistribute it; if you make a **modified** version available to users over a network, you must give them access to its source code. Strata may also be offered under a commercial licence by its maintainer; contributions are accepted under the [CLA](CLA.md). The *Source code* link at the bottom of the control panel points to `SOURCE_URL` (in `.env`): point it at your fork if you modify the code.
 
 To try it without plugging in your tools: load the demo, run `node scripts/connector-sim.mjs` (with Docker: `docker compose exec -d strata node scripts/connector-sim.mjs`) (fake Cyberwatch, GLPI, phpIPAM and PAN-OS on port 8099, with data matching the Lyon IS) and use the addresses and credentials listed at the top of the script.
 
@@ -617,4 +617,4 @@ Pushing a `vX.Y.Z` tag, or publishing a release from the web page with a new tag
 
 A version with a pre-release part (`1.0.0-rc.1`, `0.9.0-beta.2`) is published as `ghcr.io/solidgeeks/strata:1.0.0-rc.1` only, never as `latest`, and its GitHub release is marked as a pre-release: `docker compose pull` keeps the last release.
 
-Contributions follow the [Solid standard](https://github.com/SolidGeeks/.github/blob/main/CONTRIBUTING.md): sign off every commit with `git commit -s` (DCO), no CLA. To report a vulnerability, see [SECURITY.md](SECURITY.md).
+Contributions follow the [Solid standard](https://github.com/SolidGeeks/.github/blob/main/CONTRIBUTING.md) (sign off every commit with `git commit -s`, DCO), with one exception for Strata: before your first pull request is merged, you sign the [Contributor License Agreement](CLA.md) once, with a comment on the pull request. You keep the copyright of your contribution; the agreement lets the maintainer also offer Strata under a commercial licence next to the AGPL. To report a vulnerability, see [SECURITY.md](SECURITY.md).