From 377fd3b0ef9471abed509da0ca8285ae51ef5507 Mon Sep 17 00:00:00 2001 From: Jegors Cemisovs Date: Mon, 14 Sep 2026 23:32:44 +0300 Subject: [PATCH] ci: do not start CLA jobs that exit immediately MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The CLA script already returns at once for bots and for owners, members and collaborators, but only after the job has started. Hoisting the same test into a job-level condition means the job is never started at all. This repository is public, so Actions minutes are free and there is no saving here — the gain is that a pull request stops carrying a check that exists only to report that it had nothing to check. Behaviour is unchanged: the check still runs, for the external contributors it exists for, which on a public repository is the case that actually happens. Applied for consistency with the private repositories, where the same jobs were measured to cost real minutes for doing no work. Co-Authored-By: Claude Opus 5 (1M context) --- .github/workflows/cla.yaml | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/.github/workflows/cla.yaml b/.github/workflows/cla.yaml index ff75f2b..2adc8fb 100644 --- a/.github/workflows/cla.yaml +++ b/.github/workflows/cla.yaml @@ -15,6 +15,16 @@ permissions: jobs: cla-check: + # The script below already returns immediately for bots and for owners, + # members and collaborators — but only after the job has started, and a + # started job is billed a whole minute however fast it exits. Hoisting the + # same test to the job level means it is never started at all. Behaviour is + # unchanged: the check still runs, on GitHub-hosted infrastructure, for the + # external contributors it exists for. + if: >- + !endsWith(github.event.pull_request.user.login, '[bot]') && + !contains(fromJSON('["OWNER","MEMBER","COLLABORATOR"]'), + github.event.pull_request.author_association) runs-on: ubuntu-latest steps: - name: Harden the runner (audit egress)