Add snyk-bot to CLA allowlist - #63
Merged
Merged
Conversation
martyna-mindsdb
approved these changes
Sep 8, 2026
lucas-koontz
approved these changes
Sep 8, 2026
lucas-koontz
added a commit
that referenced
this pull request
Sep 8, 2026
* fix: correct snyk-bot login in CLA allowlist (was snyk-bot[bot]) #63 added snyk-bot to the CLA allowlist but wrote it as `snyk-bot[bot]`. The allowlist match is exact and case-sensitive (this file's own header: `pattern === committer`), and the real committer login on Snyk-authored commits is `snyk-bot`, no [bot] suffix -- confirmed directly from commit data on both mindsdb/anton#443 and mindsdb/cowork#836. Verified the bug is live: triggered a `recheck` on cowork#836 after #63 merged, and it still failed with "Committers ... have to sign the CLA" -- the run's own logs show `allowlist: dependabot[bot], mindsdb-release-train[bot], snyk-bot[bot]`, confirming the suffix is why it doesn't match. Also updated the header comment's now-stale "only the two" to "three", matching #63's intent. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> * test(cla): let a machine-user login satisfy the bots-only check `test_every_entry_is_a_bot` used the `[bot]` suffix as its definition of a bot, which held only while every allowlisted account was a GitHub App. Correcting `snyk-bot[bot]` to the login that actually commits, `snyk-bot`, made the list right and the test red: Snyk opens its upgrade PRs from an ordinary account it owns, so GitHub types it "User" and the login has no suffix to check. The guard the test exists for is that no PERSON is exempt from signing, and that survives. Machine accounts GitHub types "User" are named in `MACHINE_USERS`, and an entry now clears the check by carrying the reserved suffix or by appearing there. A human login that nobody named still fails, so exempting a person still means editing a named constant in front of a reviewer rather than picking a username that ends the right way. Relaxing the pattern instead, to something like a trailing `-bot`, would have exempted anyone who registered one. `snyk-bot` joins the logins pinned by `test_the_bots_that_actually_open_pull_requests_stay_exempt`, which is the assertion that was missing: with the exact login pinned, reintroducing `snyk-bot[bot]` fails the suite instead of silently exempting nobody. Lucas Koontz - Unblock the CLA check on Snyk upgrade PRs * docs(cla): the allowlist matches committers, and snyk-bot opens no pull requests Both descriptions of the allowlist named the wrong axis. The check reads the COMMITTERS of a pull request, and `dependabot[bot]` and `mindsdb-release-train[bot]` happen to be both author and committer of theirs, so "the bots that open pull requests here" described the list correctly by accident. `snyk-bot` breaks that: across every Snyk upgrade PR in the org a human opens the PR and `snyk-bot` is only the committer inside it, so the sentence claiming it opens PRs is wrong on the facts and hides why the entry is needed at all. Such a PR has two committers, and the human still signs. The README also still said two entries were listed and that they were "the only two that open pull requests anywhere in the fleet", which stopped being true when the third was added, and it is the copy a reader reaches first. Both now also record why `snyk-bot` alone carries no `[bot]` suffix: GitHub reserves that suffix for the account it mints alongside a GitHub App, and Snyk commits from an ordinary account it owns. That is the detail whose absence made `snyk-bot[bot]` look right. Lucas Koontz - Unblock the CLA check on Snyk upgrade PRs --------- Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com> Co-authored-by: Lucas Koontz <lucas.emanuel.koontz@gmail.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Add snyk bot to allowlist