From 21d95df7b2637a1343f49f34223df35d18d11335 Mon Sep 17 00:00:00 2001 From: Lucas Koontz Date: Thu, 27 Aug 2026 14:44:02 -0700 Subject: [PATCH 1/3] chore(cla): point the agreement link at the canonical repository (ENG-2017) The URL this passed was an alias that redirects to the repository actually holding the file, and it served byte-identical content, so nothing a contributor reads changes. An alias stops being harmless the moment somebody creates a repository at that name, and this is the page a contributor reads before agreeing to it. Ten library repos moved to the canonical name in the same change set; this makes all thirteen agree. Refs: ENG-2017 --- .github/workflows/cla.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/cla.yml b/.github/workflows/cla.yml index ee4287474..7f2be96ab 100644 --- a/.github/workflows/cla.yml +++ b/.github/workflows/cla.yml @@ -16,5 +16,5 @@ jobs: CLAssistant: uses: mindsdb/github-actions/.github/workflows/cla-assistant.yml@main with: - path-to-document: 'https://github.com/mindsdb/mindsdb/blob/main/assets/contributions-agreement/individual-contributor.md' + path-to-document: 'https://github.com/mindsdb/mindshub/blob/main/assets/contributions-agreement/individual-contributor.md' allowlist: bot*, ZoranPandovski, torrmal, Stpmax, mindsdbadmin, ea-rus, hamishfagg, MinuraPunchihewa, martyna-mindsdb, tino097, lucas-koontz From 8612df772036ebd65f9789f31cef8c3346995c58 Mon Sep 17 00:00:00 2001 From: Lucas Koontz Date: Thu, 27 Aug 2026 15:26:51 -0700 Subject: [PATCH 2/3] chore(cla): grant actions read rather than write (ENG-2017) The shared reusable now declares `actions: read`, so write buys this caller nothing: a called workflow can never hold more than its caller grants, and the callee's own declaration caps it further. The only write the scope would buy is pullRerunRunner.ts re-running a previously failed CLA run, and that API refuses a GITHUB_TOKEN. Dropping the scope entirely is not an option, because the same file lists the repo's workflows first and main.ts turns any throw into a failed job. This is the grant the README documents for a caller, and this repo was one of three still on the old one. --- .github/workflows/cla.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/cla.yml b/.github/workflows/cla.yml index 7f2be96ab..f3c541c5d 100644 --- a/.github/workflows/cla.yml +++ b/.github/workflows/cla.yml @@ -1,7 +1,7 @@ name: "MindsDB Anton CLA Assistant" permissions: - actions: write + actions: read contents: write pull-requests: write statuses: write From fa95db0dcc978422180d320a8c012feab4c53072 Mon Sep 17 00:00:00 2001 From: Lucas Koontz Date: Thu, 27 Aug 2026 17:16:33 -0700 Subject: [PATCH 3/3] chore(cla): stop passing an allowlist, the reusable owns it now (ENG-2017) The allowlist moved into mindsdb/github-actions and is bots only. This repo carried one of six hand-maintained copies naming people, and 11 of the 25 names across those copies had already left the org while still being exempt from signing. Staff sign like everybody else now. A bot cannot sign, so the two that actually open pull requests in this org stay exempt in the reusable. Dropping the line also drops two defects that rode inside it. `bot*` compiled to an unanchored `new RegExp("bot.*").test(login)`, so it exempted any login containing "bot", `robotnik` and `sabotage` included. And `Stpmax` never matched the real login `StpMax`, because non-wildcard entries are compared with a case-sensitive `===`. Needs mindsdb/github-actions#56 first, which gives the input a default. --- .github/workflows/cla.yml | 1 - 1 file changed, 1 deletion(-) diff --git a/.github/workflows/cla.yml b/.github/workflows/cla.yml index f3c541c5d..9628b710b 100644 --- a/.github/workflows/cla.yml +++ b/.github/workflows/cla.yml @@ -17,4 +17,3 @@ jobs: uses: mindsdb/github-actions/.github/workflows/cla-assistant.yml@main with: path-to-document: 'https://github.com/mindsdb/mindshub/blob/main/assets/contributions-agreement/individual-contributor.md' - allowlist: bot*, ZoranPandovski, torrmal, Stpmax, mindsdbadmin, ea-rus, hamishfagg, MinuraPunchihewa, martyna-mindsdb, tino097, lucas-koontz