From 76c3af9e64b68ef6a91347e108752d9b9b796b1e Mon Sep 17 00:00:00 2001 From: Massimiliano Meneghin Date: Tue, 29 Sep 2026 12:32:21 +0200 Subject: [PATCH] ci(cla): upgrade CLA Assistant action and fix CLA document link The CLA check has been failing on every PR with "Could not retrieve repository contents: Bad credentials. Status: 401" followed by "Cannot read properties of undefined (reading 'data')". The root cause is the expired CLA_BOT_SECRET PAT, which has to be rotated in repository secrets -- that is not fixable from this file. These are the surrounding cleanups: - Upgrade contributor-assistant/github-action from v2.1.3-beta to v2.6.1, clearing the Node 20 deprecation warning. Upstream archived the project in March 2026, so the action is pinned by commit SHA rather than the mutable tag. - Add an explicit permissions block. v2.6.1 needs statuses/pull-requests write to post the check and comment, and actions:write to re-run it; relying on the repository default is fragile. - Point path-to-document at the actual Autodesk Individual CLA. It was referencing Autodesk/CLA-Assistant-Test-Signatures, a setup leftover that does not match the signature store configured above. Co-authored-by: Cursor --- .github/workflows/cla.yml | 13 ++++++++++--- 1 file changed, 10 insertions(+), 3 deletions(-) diff --git a/.github/workflows/cla.yml b/.github/workflows/cla.yml index 535f7dc4..f14fbd66 100644 --- a/.github/workflows/cla.yml +++ b/.github/workflows/cla.yml @@ -5,14 +5,21 @@ on: pull_request_target: types: [opened,closed,synchronize] +permissions: + actions: write + contents: write + pull-requests: write + statuses: write + jobs: CLA-Assistant: runs-on: ubuntu-latest steps: - name: "CLA Assistant" if: (github.event.comment.body == 'recheck' || github.event.comment.body == 'I have read the CLA Document and I hereby sign the CLA') || github.event_name == 'pull_request_target' - # Beta Release - uses: contributor-assistant/github-action@v2.1.3-beta + # Upstream is archived; v2.6.1 is the final release. Pinned by commit SHA + # because the tag is mutable and no longer maintained. + uses: contributor-assistant/github-action@ca4a40a7d1004f18d9960b404b97e5f30a505a08 # v2.6.1 env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} # the below token should have repo scope and must be manually added by you in the repository's secret @@ -21,7 +28,7 @@ jobs: remote-repository-name: 'CLA-Signatures' remote-organization-name: 'Autodesk' path-to-signatures: 'signatures/Autodesk/Individual/unique.json' - path-to-document: 'https://github.com/Autodesk/CLA-Assistant-Test-Signatures/blob/master/CLA.md' # e.g. a CLA or a DCO document + path-to-document: 'https://github.com/Autodesk/autodesk.github.io/releases/download/1.0/ADSK.Form.Ind.Contrib.Agmt.for.Open.Source.docx' # branch should not be protected branch: 'master' allowlist: user1,bot*