From 1581a9e73ed5837968c42a01811d6663cac3a524 Mon Sep 17 00:00:00 2001 From: Brandon Estrella Date: Mon, 10 Aug 2026 23:06:16 -0700 Subject: [PATCH] ci: point the CLA action at a branch that exists MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The `cla` check has been failing on every open PR (#34, #36, #37, #38): ##[error]Could not retrieve repository contents. Status: 404 cla-assistant/github-action defaults `branch` to 'master'. This repo's default branch is `main` and no `master` ref exists, so the action's first call — octokit.repos.getContent({ path: pathToSignatures, ref: getBranch() }) — asks for a signature file on a ref that isn't there and 404s before it can do anything. Nothing was ever broken about the PRs themselves. Three fixes: - branch: 'main' so the ref resolves. `path-to-signatures` is also pinned explicitly rather than relying on the action's default, since the pair only makes sense read together. - contents: write. The action commits the signature file when someone signs; with contents:read it would 403 on the write immediately after the read started succeeding, trading one failure for another. - Drop `path-to-cla-assistants`, which is not an input this action accepts and was logged as `Unexpected input(s)` on every run. Note that `license/cla` (the cla-assistant.io status check) has been passing throughout — only the GitHub Action was failing, so signature enforcement was never actually bypassed. Signatures will land on `main` as `signatures/cla.json`. That triggers CI and Release on each new signer; semantic-release no-ops on a non-conventional commit, and new signers are rare. If that noise ever matters, the alternative is a dedicated `cla-signatures` branch — which has to exist first, or it reproduces this exact bug. --- .github/workflows/cla.yml | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/.github/workflows/cla.yml b/.github/workflows/cla.yml index 2a0d89b..66925ba 100644 --- a/.github/workflows/cla.yml +++ b/.github/workflows/cla.yml @@ -8,7 +8,9 @@ on: permissions: actions: write - contents: read + # write, not read: the action commits the signature file to `signatures/cla.json` + # on the branch below. With read it can never record a signature. + contents: write pull-requests: write statuses: write @@ -26,5 +28,9 @@ jobs: PERSONAL_ACCESS_TOKEN: ${{ secrets.CLA_ASSISTANT_PAT }} with: path-to-document: 'https://github.com/linkforty/core/blob/main/CLA.md' - path-to-cla-assistants: 'https://cla-assistant.io/' + # The action defaults this to 'master', which does not exist in this + # repo — it read signatures from a missing ref and failed every run with + # "Could not retrieve repository contents. Status: 404". + branch: 'main' + path-to-signatures: 'signatures/cla.json' allowlist: 'bot*,dependabot*,github-actions*'