Repository navigation
Conversation
The workflow gate compared the comment body with the sign phrase using exact equality, so "... I hereby sign the CLA." (or a trailing newline) skipped the CLA Assistant step without recording a signature, while the run still reported success. contains() is case-insensitive and matches what the action itself accepts (it trims, lowercases and allows text around the phrase), so the action stays the authority on the wording. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The CLA workflow only runs its step when the comment body is exactly the sign phrase. A comment like "I have read the CLA Document and I hereby sign the CLA." (trailing period), or one with a trailing newline, skips the step without recording a signature, and the run still reports success. This happened on #155: the first signing comment had a period, and only a second, exact comment went through.
The action itself is lenient. At v2.3.0,
src/pullrequest/signatureComment.tstrims and lowercases the comment and matches/^.*i \s*have \s*read \s*the \s*cla \s*document \s*and \s*i \s*hereby \s*sign \s*the \s*cla.*$/. So the only strict check is theif:gate, which keeps such comments from reaching the action.This changes the gate to
contains(...). GitHub Actions'contains()is case-insensitive, so the gate now passes what the action accepts, and the action still decides whether a comment is a valid signature.recheckand thepull_request_targettrigger are unchanged. Becausepull_request_targetandissue_commentrun the workflow frommain, this PR's own check still uses the current workflow.🤖 Generated with Claude Code