fix: correct snyk-bot login in CLA allowlist (was snyk-bot[bot]) - #65
Merged
Merged
Conversation
#63 added snyk-bot to the CLA allowlist but wrote it as `snyk-bot[bot]`. The allowlist match is exact and case-sensitive (this file's own header: `pattern === committer`), and the real committer login on Snyk-authored commits is `snyk-bot`, no [bot] suffix -- confirmed directly from commit data on both mindsdb/anton#443 and mindsdb/cowork#836. Verified the bug is live: triggered a `recheck` on cowork#836 after #63 merged, and it still failed with "Committers ... have to sign the CLA" -- the run's own logs show `allowlist: dependabot[bot], mindsdb-release-train[bot], snyk-bot[bot]`, confirming the suffix is why it doesn't match. Also updated the header comment's now-stale "only the two" to "three", matching #63's intent. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
martyna-mindsdb
requested review from
a team,
ZoranPandovski and
lucas-koontz
September 8, 2026 16:16
`test_every_entry_is_a_bot` used the `[bot]` suffix as its definition of a bot, which held only while every allowlisted account was a GitHub App. Correcting `snyk-bot[bot]` to the login that actually commits, `snyk-bot`, made the list right and the test red: Snyk opens its upgrade PRs from an ordinary account it owns, so GitHub types it "User" and the login has no suffix to check. The guard the test exists for is that no PERSON is exempt from signing, and that survives. Machine accounts GitHub types "User" are named in `MACHINE_USERS`, and an entry now clears the check by carrying the reserved suffix or by appearing there. A human login that nobody named still fails, so exempting a person still means editing a named constant in front of a reviewer rather than picking a username that ends the right way. Relaxing the pattern instead, to something like a trailing `-bot`, would have exempted anyone who registered one. `snyk-bot` joins the logins pinned by `test_the_bots_that_actually_open_pull_requests_stay_exempt`, which is the assertion that was missing: with the exact login pinned, reintroducing `snyk-bot[bot]` fails the suite instead of silently exempting nobody. Lucas Koontz - Unblock the CLA check on Snyk upgrade PRs
…ll requests Both descriptions of the allowlist named the wrong axis. The check reads the COMMITTERS of a pull request, and `dependabot[bot]` and `mindsdb-release-train[bot]` happen to be both author and committer of theirs, so "the bots that open pull requests here" described the list correctly by accident. `snyk-bot` breaks that: across every Snyk upgrade PR in the org a human opens the PR and `snyk-bot` is only the committer inside it, so the sentence claiming it opens PRs is wrong on the facts and hides why the entry is needed at all. Such a PR has two committers, and the human still signs. The README also still said two entries were listed and that they were "the only two that open pull requests anywhere in the fleet", which stopped being true when the third was added, and it is the copy a reader reaches first. Both now also record why `snyk-bot` alone carries no `[bot]` suffix: GitHub reserves that suffix for the account it mints alongside a GitHub App, and Snyk commits from an ordinary account it owns. That is the detail whose absence made `snyk-bot[bot]` look right. Lucas Koontz - Unblock the CLA check on Snyk upgrade PRs
lucas-koontz
approved these changes
Sep 8, 2026
mindsdb-devops
approved these changes
Sep 8, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
#63 added
snyk-botto the CLA allowlist but wrote it assnyk-bot[bot]. The allowlist match is exact and case-sensitive (per this file's own header:pattern === committer), and the real committer login on Snyk-authored commits issnyk-bot— no[bot]suffix. Confirmed directly from commit data on bothmindsdb/anton#443 andmindsdb/cowork#836.Verified the bug is live
Triggered a
recheckoncowork#836 after #63 merged — it still failed with "Committers ... have to sign the CLA". The run's own logs showallowlist: dependabot[bot], mindsdb-release-train[bot], snyk-bot[bot], confirming the suffix is why it doesn't match the real login.Also
Updated the header comment's now-stale "only the two" to "three", matching #63's intent.
🤖 Generated with Claude Code