Call the organization's own CAA workflow

[gafferongames]

The caller half of mas-bandwidth/.github#2. Nothing merges here until that one
does.

cla.yml drops from 195 lines to 36: the triggers, the permissions, and a call
to the reusable workflow this organization owns. Everything the old file
explained about the archived action's limits, and about recording a signature by
hand, now lives with the workflow and with the ledger it writes.

What changes for a contributor

Nothing. The same sentence signs, on the same thread, and every signature
already in the ledger still counts.

What changes for us

• The gate runs code we own, in Go, in mas-bandwidth/.github, pinned here by
  full commit SHA. contributor-assistant/github-action is archived and v2.6.1
  is its last release.
• permissions narrows: actions: write is gone, contents is read only, and
  what is left is pull-requests: write to post the ask and statuses: write
  to set the gate.
• The credential narrows. CLA_SIGNATURES_TOKEN had write on every library
  repository. CAA_LEDGER_TOKEN may write the contents of
  mas-bandwidth/.github and nothing else.
• The gate name moves from an Actions check to a commit status. The
  organization ruleset Require CAA signature requires a check named caa on
  the default branch of eleven repositories, and a reusable workflow renames its
  Actions check to caa / caa. The workflow therefore sets a commit status
  named caa on every run, whatever the verdict, and a required check name
  matches a commit status as readily as a check run. schema is not in that
  ruleset, which is why it goes first: if the status does not appear as
  expected, nothing here is blocked while we find out.

The credential

One fine-grained personal access token, created once:

• Resource owner: mas-bandwidth
• Repository access: only select repositories, mas-bandwidth/.github
• Repository permissions: Contents: Read and write. Nothing else.
• Organization permissions: none
• Expiry: 1 year

Store it once, as an organization secret named CAA_LEDGER_TOKEN, with
repository access granted to the calling repositories. No per-repository secret
is created. This file passes it through explicitly rather than with
secrets: inherit, so the reusable workflow sees that one secret and no other.

Rollout

1. Create the PAT, set the organization secret CAA_LEDGER_TOKEN, grant it to
   schema and to the eleven repositories in the ruleset.
2. Merge Own the CAA gate: a reusable workflow and a Go program in this repository .github#2 first.
3. Repoint the uses: line here to that merge commit SHA, and its trailing
   comment to # mas-bandwidth/.github main, then merge this. Watch
   one pull request through the gate.
4. Move the eleven ruleset repositories the same way, yojimbo first, one at a
   time, confirming the caa status appears on a pull request in each before
   moving to the next. Each is a one file follow-up; all eleven carry the same
   file, byte for byte, today: netcode, reliable, serialize, yojimbo,
   fixed3d, netcode.go, netcode.rs, reliable.go, reliable.rs,
   serialize.go and serialize.rs.
5. After the last caller moves, revoke CLA_SIGNATURES_TOKEN and delete the
   secret from every repository and from the organization.

🤖 Generated with Claude Code