From b18ab95139f5f06e18e66a693a4b3a507702cb8e Mon Sep 17 00:00:00 2001 From: Mykhailo Stadnyk Date: Tue, 8 Sep 2026 20:55:19 +0200 Subject: [PATCH] fix(cla): store signatures off master, where a bot can write them MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit CLA Assistant records a signature by committing `signatures/version1/cla.json` directly to the branch it is pointed at. That branch was `master`, which a ruleset covers: every push needs the `attribution / No AI attribution` check, and a bot commit carries no check at all. So the write was rejected — "Repository rule violations found" — the signature was never stored, the check stayed red, and no outside contribution could be merged. The action's own error says it: the branch where signatures are stored must not be protected. Signatures now live on the unprotected `cla-signatures` branch, which holds that one file and a README explaining why it is off to the side. Nothing was migrated because nothing had ever been successfully written. --- .github/workflows/cla.yml | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/.github/workflows/cla.yml b/.github/workflows/cla.yml index 4fdcb29..362edcb 100644 --- a/.github/workflows/cla.yml +++ b/.github/workflows/cla.yml @@ -27,7 +27,12 @@ jobs: with: path-to-signatures: 'signatures/version1/cla.json' path-to-document: 'https://github.com/imqueue/.github/blob/master/CONTRIBUTION-TERMS.md' - branch: 'master' + # NOT master, and not any branch that gains a ruleset later. The bot + # writes this file with a direct commit, which cannot satisfy the + # `attribution / No AI attribution` check master requires — every + # signature failed to record, so no outside contribution could be + # merged. The branch holds the signature file and nothing else. + branch: 'cla-signatures' allowlist: 'dependabot[bot],*[bot]' custom-notsigned-prcomment: >- Thank you for your contribution to **@imqueue**. Before this pull