refactor(signing): extract render/notices.ts #1060
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # CLA Assistant — every external PR must sign CLA.md before merge. | |
| # | |
| # Stores signatures as `signatures/version1/cla.json` on the | |
| # `cla-signatures` branch (auto-created on first sign), so main stays | |
| # free of bot-generated commits. | |
| # | |
| # NOTE on action choice: contributor-assistant/github-action was archived | |
| # 2026-03-23. v2.6.1 still works — the GitHub APIs it uses (PR comments, | |
| # OAuth identity) are stable. If it ever breaks, the migration paths are | |
| # (a) the hosted https://cla-assistant.io GitHub App (signatures via web | |
| # UI instead of in-repo), or (b) replace this workflow with a custom | |
| # action that scans PR comments for the sign-off line and writes to | |
| # the signatures file directly. | |
| name: CLA Assistant | |
| on: | |
| issue_comment: | |
| types: [created] | |
| pull_request_target: | |
| types: [opened, closed, synchronize] | |
| # pull_request_target runs in the base repo's context with write | |
| # permissions even for fork PRs — required so the bot can comment on | |
| # fork PRs and update signatures. The workflow itself does NOT execute | |
| # any code from the PR (no checkout of PR head, no install/build), so | |
| # the elevated permissions stay safe. | |
| permissions: | |
| actions: write | |
| contents: write | |
| pull-requests: write | |
| statuses: write | |
| jobs: | |
| cla: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: CLA Assistant | |
| if: | | |
| (github.event.comment.body == 'recheck' || | |
| github.event.comment.body == 'I have read the CLA Document and I hereby sign the CLA') || | |
| github.event_name == 'pull_request_target' | |
| uses: contributor-assistant/github-action@v2.6.1 | |
| env: | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| with: | |
| path-to-document: 'https://github.com/szhygulin/vaultpilot-mcp/blob/main/CLA.md' | |
| path-to-signatures: 'signatures/version1/cla.json' | |
| branch: 'cla-signatures' | |
| # Repo owner doesn't sign their own CLA. Dependabot bumps are | |
| # mechanical (not "contributions" in the IP sense) so we skip | |
| # them too — same pattern most BUSL projects use. | |
| # | |
| # `claude` covers Claude Code's `Co-Authored-By: Claude ... | |
| # <noreply@anthropic.com>` trailer (resolves to the `claude` | |
| # GitHub identity). Claude is a tool used by szhygulin to | |
| # author commits, not a contributor in the IP sense — the | |
| # human running the model holds the copyright. The trailing | |
| # `*[bot]` wildcard catches any future bot accounts (renovate, | |
| # release-please, etc.) so we don't have to amend this file | |
| # every time a new bot lands a PR. | |
| allowlist: 'szhygulin,claude,dependabot[bot],*[bot]' | |
| custom-notsigned-prcomment: | | |
| Thanks for the contribution! Before this PR can be merged, please sign the [Contributor License Agreement](https://github.com/szhygulin/vaultpilot-mcp/blob/main/CLA.md). The CLA grants the project the right to relicense your contribution under future license terms (the project ships under [BUSL-1.1](https://github.com/szhygulin/vaultpilot-mcp/blob/main/LICENSE) today, auto-converting to Apache 2.0 in 2030). | |
| To sign, **post a new comment on this PR with exactly the following text**: | |
| custom-pr-sign-comment: 'I have read the CLA Document and I hereby sign the CLA' | |
| custom-allsigned-prcomment: '✅ All contributors have signed the CLA — thank you!' |