Ultralytics CLA Action

Checks every pull request commit author against the shared signature ledger in ultralytics/cla and maintains one status comment on the pull request.

name: CLA
on:
  issue_comment:
    types: [created]
  pull_request_target:
    types: [reopened, opened, synchronize]

permissions:
  actions: write
  pull-requests: write

jobs:
  CLA:
    if: github.event_name == 'pull_request_target' || (github.event.issue.pull_request && (github.event.comment.body == 'recheck' || github.event.comment.body == 'I have read the CLA Document and I sign the CLA'))
    concurrency:
      group: cla-${{ github.event.pull_request.number || github.event.issue.number }}
    runs-on: ubuntu-latest
    steps:
      - name: CLA
        uses: ultralytics/actions/cla@main
        with:
          github-token: ${{ secrets.GITHUB_TOKEN }}
          cla-token: ${{ secrets._GITHUB_TOKEN }}

The action preserves the existing signatures/version1/cla.json schema and updates its cla-signatures branch with optimistic concurrency. Missing or invalid ledger data, unlinked commit authors, and unsigned contributors fail the check.

Contributor identity uses GitHub's numeric user ID, so commits from any email address GitHub associates with the same account require only one signature. Raw unlinked commit emails are never guessed or treated as identity.

The workflow requires actions: write to refresh the PR-head check after a signature comment and pull-requests: write to maintain its single status comment. cla-token should be a fine-grained token restricted to ultralytics/cla with Contents: read and write access. It never checks out or executes pull request code.

1.7 KiB Raw Permalink Blame History

Ultralytics CLA Action

1.7 KiB

Raw Permalink Blame History